[STATEMENT]
theorem eval_evals_exec_type_sound:
"wf_java_prog G ==>
  (G\<turnstile>(x,(h,l)) -e  \<succ>v  -> (x', (h',l')) -->
      (\<forall>lT.   (x,(h ,l ))::\<preceq>(G,lT) --> (\<forall>T . (G,lT)\<turnstile>e  :: T -->
      h\<le>|h' \<and> (x',(h',l'))::\<preceq>(G,lT) \<and> (x'=None --> G,h'\<turnstile>v  ::\<preceq> T )))) \<and>
  (G\<turnstile>(x,(h,l)) -es[\<succ>]vs-> (x', (h',l')) -->
      (\<forall>lT.   (x,(h ,l ))::\<preceq>(G,lT) --> (\<forall>Ts. (G,lT)\<turnstile>es[::]Ts -->
      h\<le>|h' \<and> (x',(h',l'))::\<preceq>(G,lT) \<and> (x'=None --> list_all2 (\<lambda>v T. G,h'\<turnstile>v::\<preceq>T) vs Ts)))) \<and>
  (G\<turnstile>(x,(h,l)) -c       -> (x', (h',l')) -->
      (\<forall>lT.   (x,(h ,l ))::\<preceq>(G,lT) -->       (G,lT)\<turnstile>c  \<surd> -->
      h\<le>|h' \<and> (x',(h',l'))::\<preceq>(G,lT)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf_java_prog G \<Longrightarrow> (G \<turnstile> (x, h, l) -e\<succ>v-> (x', h', l') \<longrightarrow> (\<forall>lT. (x, h, l) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> h \<le>| h' \<and> (x', h', l') ::\<preceq> (G, lT) \<and> (x' = None \<longrightarrow> G,h' \<turnstile> v ::\<preceq> T)))) \<and> (G \<turnstile> (x, h, l) -es[\<succ>]vs-> (x', h', l') \<longrightarrow> (\<forall>lT. (x, h, l) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> es [::] Ts \<longrightarrow> h \<le>| h' \<and> (x', h', l') ::\<preceq> (G, lT) \<and> (x' = None \<longrightarrow> list_all2 (conf G h') vs Ts)))) \<and> (G \<turnstile> (x, h, l) -c-> (x', h', l') \<longrightarrow> (\<forall>lT. (x, h, l) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> c \<surd> \<longrightarrow> h \<le>| h' \<and> (x', h', l') ::\<preceq> (G, lT)))
[PROOF STEP]
apply( rule eval_evals_exec_induct)
[PROOF STATE]
proof (prove)
goal (20 subgoals):
 1. \<And>xc a b e. wf_java_prog G \<Longrightarrow> \<forall>lT. (Some xc, a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| a \<and> (Some xc, a, b) ::\<preceq> (G, lT) \<and> (Some xc = None \<longrightarrow> G,a \<turnstile> undefined ::\<preceq> T))
 2. \<And>h a b aa x h' C. \<lbrakk>wf_java_prog G; h = fst (a, b); (aa, x) = new_Addr h; h' = h(aa \<mapsto> (C, init_vars (fields (G, C))))\<rbrakk> \<Longrightarrow> case c_hupd h' (x, a, b) of (v, c, d) \<Rightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> NewC C :: T \<longrightarrow> a \<le>| c \<and> (v, c, d) ::\<preceq> (G, lT) \<and> (v = None \<longrightarrow> G,c \<turnstile> Addr aa ::\<preceq> T))
 3. \<And>a b e v x1 aa ba x2 C. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); x2 = raise_if (\<not> cast_ok G C (fst (aa, ba)) v) ClassCast x1\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> Cast C e :: T \<longrightarrow> a \<le>| aa \<and> (x2, aa, ba) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T))
 4. \<And>a b v. wf_java_prog G \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> Lit v :: T \<longrightarrow> a \<le>| a \<and> Norm (a, b) ::\<preceq> (G, lT) \<and> (None = None \<longrightarrow> G,a \<turnstile> v ::\<preceq> T))
 5. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); v = (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2))\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> BinOp bop e1 e2 :: T \<longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T))
 6. \<And>a b v. wf_java_prog G \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> LAcc v :: T \<longrightarrow> a \<le>| a \<and> Norm (a, b) ::\<preceq> (G, lT) \<and> (None = None \<longrightarrow> G,a \<turnstile> the (snd (a, b) v) ::\<preceq> T))
 7. \<And>a b e v x h l l' va. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); l' = (if x = None then l(va \<mapsto> v) else l)\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> va::=e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l') ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T))
 8. \<And>a b e a' x1 aa ba v fn T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); v = the (snd (the (fst (aa, ba) (the_Addr a'))) (fn, T))\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ta. (G, lT) \<turnstile> {T}e..fn :: Ta \<longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Ta))
 9. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); ab = the_Addr a'; G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); h = fst (ac, bb); (c, fs) = the (h ab); h' = h(ab \<mapsto> (c, fs((fn, T) \<mapsto> v)))\<rbrakk> \<Longrightarrow> case c_hupd h' (x2, ac, bb) of (va, c, d) \<Rightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ta. (G, lT) \<turnstile> {T}e1..fn:=e2 :: Ta \<longrightarrow> a \<le>| c \<and> (va, c, d) ::\<preceq> (G, lT) \<and> (va = None \<longrightarrow> G,c \<turnstile> v ::\<preceq> Ta))
 10. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); ac = the_Addr a'; G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); dynT = fst (the (h ac)); (md, rT, pns, lvars, blk, res) = the (method (G, dynT) (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T))\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> {C}e..mn( {pTs}ps) :: T \<longrightarrow> a \<le>| fst (af, bc) \<and> (x4, fst (af, bc), l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,fst (af, bc) \<turnstile> v ::\<preceq> T))
A total of 20 subgoals...
[PROOF STEP]
apply( unfold c_hupd_def)

\<comment> \<open>several simplifications, XcptE, XcptEs, XcptS, Skip, Nil??\<close>
[PROOF STATE]
proof (prove)
goal (20 subgoals):
 1. \<And>xc a b e. wf_java_prog G \<Longrightarrow> \<forall>lT. (Some xc, a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| a \<and> (Some xc, a, b) ::\<preceq> (G, lT) \<and> (Some xc = None \<longrightarrow> G,a \<turnstile> undefined ::\<preceq> T))
 2. \<And>h a b aa x h' C. \<lbrakk>wf_java_prog G; h = fst (a, b); (aa, x) = new_Addr h; h' = h(aa \<mapsto> (C, init_vars (fields (G, C))))\<rbrakk> \<Longrightarrow> case case (x, a, b) of (xo, h, l) \<Rightarrow> if xo = None then Norm (h', l) else (xo, h, l) of (v, c, d) \<Rightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> NewC C :: T \<longrightarrow> a \<le>| c \<and> (v, c, d) ::\<preceq> (G, lT) \<and> (v = None \<longrightarrow> G,c \<turnstile> Addr aa ::\<preceq> T))
 3. \<And>a b e v x1 aa ba x2 C. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); x2 = raise_if (\<not> cast_ok G C (fst (aa, ba)) v) ClassCast x1\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> Cast C e :: T \<longrightarrow> a \<le>| aa \<and> (x2, aa, ba) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T))
 4. \<And>a b v. wf_java_prog G \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> Lit v :: T \<longrightarrow> a \<le>| a \<and> Norm (a, b) ::\<preceq> (G, lT) \<and> (None = None \<longrightarrow> G,a \<turnstile> v ::\<preceq> T))
 5. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); v = (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2))\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> BinOp bop e1 e2 :: T \<longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T))
 6. \<And>a b v. wf_java_prog G \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> LAcc v :: T \<longrightarrow> a \<le>| a \<and> Norm (a, b) ::\<preceq> (G, lT) \<and> (None = None \<longrightarrow> G,a \<turnstile> the (snd (a, b) v) ::\<preceq> T))
 7. \<And>a b e v x h l l' va. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); l' = (if x = None then l(va \<mapsto> v) else l)\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> va::=e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l') ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T))
 8. \<And>a b e a' x1 aa ba v fn T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); v = the (snd (the (fst (aa, ba) (the_Addr a'))) (fn, T))\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ta. (G, lT) \<turnstile> {T}e..fn :: Ta \<longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Ta))
 9. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); ab = the_Addr a'; G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); h = fst (ac, bb); (c, fs) = the (h ab); h' = h(ab \<mapsto> (c, fs((fn, T) \<mapsto> v)))\<rbrakk> \<Longrightarrow> case case (x2, ac, bb) of (xo, h, l) \<Rightarrow> if xo = None then Norm (h', l) else (xo, h, l) of (va, c, d) \<Rightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ta. (G, lT) \<turnstile> {T}e1..fn:=e2 :: Ta \<longrightarrow> a \<le>| c \<and> (va, c, d) ::\<preceq> (G, lT) \<and> (va = None \<longrightarrow> G,c \<turnstile> v ::\<preceq> Ta))
 10. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); ac = the_Addr a'; G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); dynT = fst (the (h ac)); (md, rT, pns, lvars, blk, res) = the (method (G, dynT) (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T))\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> {C}e..mn( {pTs}ps) :: T \<longrightarrow> a \<le>| fst (af, bc) \<and> (x4, fst (af, bc), l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,fst (af, bc) \<turnstile> v ::\<preceq> T))
A total of 20 subgoals...
[PROOF STEP]
apply( simp_all)
[PROOF STATE]
proof (prove)
goal (16 subgoals):
 1. \<And>h a b aa x h' C. \<lbrakk>wf_java_prog G; h = a; (aa, x) = new_Addr a; h' = a(aa \<mapsto> (C, init_vars (fields (G, C))))\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> NewC C :: T \<longrightarrow> a \<le>| fst (snd (if x = None then Norm (h', b) else (fst (x, a, b), fst (a, b), b))) \<and> (if x = None then Norm (h', b) else (fst (x, a, b), fst (a, b), b)) ::\<preceq> (G, lT) \<and> (fst (if x = None then Norm (h', b) else (fst (x, a, b), fst (a, b), b)) = None \<longrightarrow> G,fst (snd (if x = None then Norm (h', b) else (fst (x, a, b), fst (a, b), b))) \<turnstile> Addr aa ::\<preceq> T))
 2. \<And>a b e v x1 aa ba x2 C. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); x2 = raise_if (\<not> cast_ok G C aa v) ClassCast x1\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> Cast C e :: T \<longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T))
 3. \<And>a b v. wf_java_prog G \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> Lit v :: T \<longrightarrow> G,a \<turnstile> v ::\<preceq> T)
 4. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); v = (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2))\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> BinOp bop e1 e2 :: T \<longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T))
 5. \<And>a b v. wf_java_prog G \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> LAcc v :: T \<longrightarrow> G,a \<turnstile> the (b v) ::\<preceq> T)
 6. \<And>a b e v x h l l' va. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); l' = (if x = None then l(va \<mapsto> v) else l)\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> va::=e :: T \<longrightarrow> a \<le>| h \<and> (x, h, if x = None then l(va \<mapsto> v) else l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T))
 7. \<And>a b e a' x1 aa ba v fn T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); v = the (snd (the (aa (the_Addr a'))) (fn, T))\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ta. (G, lT) \<turnstile> {T}e..fn :: Ta \<longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> Ta))
 8. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); ab = the_Addr a'; G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); h = ac; (c, fs) = the (ac (the_Addr a')); h' = ac(the_Addr a' \<mapsto> (c, fs((fn, T) \<mapsto> v)))\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ta. (G, lT) \<turnstile> {T}e1..fn:=e2 :: Ta \<longrightarrow> a \<le>| fst (snd (if x2 = None then Norm (h', bb) else (fst (x2, ac, bb), fst (ac, bb), bb))) \<and> (if x2 = None then Norm (h', bb) else (fst (x2, ac, bb), fst (ac, bb), bb)) ::\<preceq> (G, lT) \<and> (fst (if x2 = None then Norm (h', bb) else (fst (x2, ac, bb), fst (ac, bb), bb)) = None \<longrightarrow> G,fst (snd (if x2 = None then Norm (h', bb) else (fst (x2, ac, bb), fst (ac, bb), bb))) \<turnstile> v ::\<preceq> Ta))
 9. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); ac = the_Addr a'; G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); dynT = cname_of h a'; (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T))\<rbrakk> \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> {C}e..mn( {pTs}ps) :: T \<longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T))
 10. \<And>a b. wf_java_prog G \<Longrightarrow> \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> [] [::] Ts \<longrightarrow> Ts = [])
A total of 16 subgoals...
[PROOF STEP]
apply( tactic "ALLGOALS (REPEAT o resolve_tac \<^context> [impI, allI])")
[PROOF STATE]
proof (prove)
goal (16 subgoals):
 1. \<And>h a b aa x h' C lT T. \<lbrakk>wf_java_prog G; h = a; (aa, x) = new_Addr a; h' = a(aa \<mapsto> (C, init_vars (fields (G, C)))); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> NewC C :: T\<rbrakk> \<Longrightarrow> a \<le>| fst (snd (if x = None then Norm (h', b) else (fst (x, a, b), fst (a, b), b))) \<and> (if x = None then Norm (h', b) else (fst (x, a, b), fst (a, b), b)) ::\<preceq> (G, lT) \<and> (fst (if x = None then Norm (h', b) else (fst (x, a, b), fst (a, b), b)) = None \<longrightarrow> G,fst (snd (if x = None then Norm (h', b) else (fst (x, a, b), fst (a, b), b))) \<turnstile> Addr aa ::\<preceq> T)
 2. \<And>a b e v x1 aa ba x2 C lT T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); x2 = raise_if (\<not> cast_ok G C aa v) ClassCast x1; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> Cast C e :: T\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)
 3. \<And>a b v lT T. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> Lit v :: T\<rbrakk> \<Longrightarrow> G,a \<turnstile> v ::\<preceq> T
 4. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); v = (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> BinOp bop e1 e2 :: T\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T)
 5. \<And>a b v lT T. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> LAcc v :: T\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b v) ::\<preceq> T
 6. \<And>a b e v x h l l' va lT T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); l' = (if x = None then l(va \<mapsto> v) else l); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> va::=e :: T\<rbrakk> \<Longrightarrow> a \<le>| h \<and> (x, h, if x = None then l(va \<mapsto> v) else l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)
 7. \<And>a b e a' x1 aa ba v fn T lT Ta. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); v = the (snd (the (aa (the_Addr a'))) (fn, T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {T}e..fn :: Ta\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> Ta)
 8. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); ab = the_Addr a'; G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); h = ac; (c, fs) = the (ac (the_Addr a')); h' = ac(the_Addr a' \<mapsto> (c, fs((fn, T) \<mapsto> v))); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {T}e1..fn:=e2 :: Ta\<rbrakk> \<Longrightarrow> a \<le>| fst (snd (if x2 = None then Norm (h', bb) else (fst (x2, ac, bb), fst (ac, bb), bb))) \<and> (if x2 = None then Norm (h', bb) else (fst (x2, ac, bb), fst (ac, bb), bb)) ::\<preceq> (G, lT) \<and> (fst (if x2 = None then Norm (h', bb) else (fst (x2, ac, bb), fst (ac, bb), bb)) = None \<longrightarrow> G,fst (snd (if x2 = None then Norm (h', bb) else (fst (x2, ac, bb), fst (ac, bb), bb))) \<turnstile> v ::\<preceq> Ta)
 9. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); ac = the_Addr a'; G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); dynT = cname_of h a'; (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {C}e..mn( {pTs}ps) :: T\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)
 10. \<And>a b lT Ts. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> [] [::] Ts\<rbrakk> \<Longrightarrow> Ts = []
A total of 16 subgoals...
[PROOF STEP]
apply( tactic \<open>ALLGOALS (eresolve_tac \<^context> [@{thm ty_expr.cases}, @{thm ty_exprs.cases}, @{thm wt_stmt.cases}]
  THEN_ALL_NEW (full_simp_tac (put_simpset (simpset_of \<^theory_context>\<open>Conform\<close>) \<^context>)))\<close>)
[PROOF STATE]
proof (prove)
goal (15 subgoals):
 1. \<And>h a b aa x h' C lT T E Ca. \<lbrakk>wf_java_prog G; h = a; (aa, x) = new_Addr a; h' = a(aa \<mapsto> (C, init_vars (fields (G, C)))); Norm (a, b) ::\<preceq> (G, lT); (G, lT) = E; C = Ca; T = Class Ca; is_class (fst E) Ca\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h' \<and> Norm (h', b) ::\<preceq> (G, lT) \<and> G,h' \<turnstile> Addr aa ::\<preceq> T) \<and> ((\<exists>y. x = Some y) \<longrightarrow> (x, a, b) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,a \<turnstile> Addr aa ::\<preceq> T))
 2. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); x2 = raise_if (\<not> cast_ok G C aa v) ClassCast x1; Norm (a, b) ::\<preceq> (G, lT); (G, lT) = E; e = ea; T = Class C; E \<turnstile> ea :: Ca; is_class (fst E) C; fst E \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)
 3. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); (G, lT) = E; v = x; T = Ta; typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> v ::\<preceq> T
 4. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); v = (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) = E; e1 = e1a; T = T'; E \<turnstile> e1a :: Ta; E \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T)
 5. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); (G, lT) = E; v = va; T = Ta; snd E va = Some Ta; is_type (fst E) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b v) ::\<preceq> T
 6. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); l' = (if x = None then l(va \<mapsto> v) else l); Norm (a, b) ::\<preceq> (G, lT); (G, lT) = E; va = vb; T = T'; vb \<noteq> This; E \<turnstile> LAcc vb :: Ta; E \<turnstile> e :: T'; fst E \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(va \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T) \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T))
 7. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); v = the (snd (the (aa (the_Addr a'))) (fn, T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) = E; e = ab; Ta = fT; E \<turnstile> ab :: Class C; field (fst E, C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> Ta)
 8. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); ab = the_Addr a'; G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); h = ac; (c, fs) = the (ac (the_Addr a')); h' = ac(the_Addr a' \<mapsto> (c, fs((fn, T) \<mapsto> v))); Norm (a, b) ::\<preceq> (G, lT); (G, lT) = E; T = fd; Ta = T'; E \<turnstile> {fd}e1..fn :: Tb; E \<turnstile> e2 :: T'; fst E \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| h' \<and> Norm (h', bb) ::\<preceq> (G, lT) \<and> G,h' \<turnstile> v ::\<preceq> Ta) \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> Ta))
 9. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); ac = the_Addr a'; G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); dynT = cname_of h a'; (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) = E; e = ag; T = rTa; E \<turnstile> ag :: Class C; E \<turnstile> ps [::] pTsa; max_spec (fst E) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)
 10. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> es [::] Ts \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) vs Ts)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) = E; e = ea; Ts = T # Tsa; E \<turnstile> ea :: T; E \<turnstile> es [::] Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) Ts)
A total of 15 subgoals...
[PROOF STEP]
apply(tactic "ALLGOALS (EVERY' [REPEAT o (eresolve_tac \<^context> [conjE]), REPEAT o hyp_subst_tac \<^context>])")

\<comment> \<open>Level 7\<close>
\<comment> \<open>15 NewC\<close>
[PROOF STATE]
proof (prove)
goal (15 subgoals):
 1. \<And>h a b aa x h' C lT T E Ca. \<lbrakk>wf_java_prog G; (aa, x) = new_Addr a; Norm (a, b) ::\<preceq> (G, lT); is_class (fst (G, lT)) Ca\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<and> Norm (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))), b) ::\<preceq> (G, lT) \<and> G,a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<turnstile> Addr aa ::\<preceq> Class Ca) \<and> ((\<exists>y. x = Some y) \<longrightarrow> (x, a, b) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,a \<turnstile> Addr aa ::\<preceq> Class Ca))
 2. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 3. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 4. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 5. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 6. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 7. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 8. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 9. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 10. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> es [::] Ts \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) vs Ts)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
A total of 15 subgoals...
[PROOF STEP]
apply (drule sym)
[PROOF STATE]
proof (prove)
goal (15 subgoals):
 1. \<And>h a b aa x h' C lT T E Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class (fst (G, lT)) Ca; new_Addr a = (aa, x)\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<and> Norm (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))), b) ::\<preceq> (G, lT) \<and> G,a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<turnstile> Addr aa ::\<preceq> Class Ca) \<and> ((\<exists>y. x = Some y) \<longrightarrow> (x, a, b) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,a \<turnstile> Addr aa ::\<preceq> Class Ca))
 2. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 3. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 4. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 5. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 6. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 7. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 8. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 9. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 10. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> es [::] Ts \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) vs Ts)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
A total of 15 subgoals...
[PROOF STEP]
apply( drule new_AddrD)
[PROOF STATE]
proof (prove)
goal (15 subgoals):
 1. \<And>h a b aa x h' C lT T E Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class (fst (G, lT)) Ca; a aa = None \<and> x = None \<or> x = Some (Addr (XcptRef OutOfMemory))\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<and> Norm (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))), b) ::\<preceq> (G, lT) \<and> G,a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<turnstile> Addr aa ::\<preceq> Class Ca) \<and> ((\<exists>y. x = Some y) \<longrightarrow> (x, a, b) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,a \<turnstile> Addr aa ::\<preceq> Class Ca))
 2. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 3. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 4. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 5. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 6. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 7. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 8. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 9. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 10. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> es [::] Ts \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) vs Ts)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
A total of 15 subgoals...
[PROOF STEP]
apply( erule disjE)
[PROOF STATE]
proof (prove)
goal (16 subgoals):
 1. \<And>h a b aa x h' C lT T E Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class (fst (G, lT)) Ca; a aa = None \<and> x = None\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<and> Norm (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))), b) ::\<preceq> (G, lT) \<and> G,a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<turnstile> Addr aa ::\<preceq> Class Ca) \<and> ((\<exists>y. x = Some y) \<longrightarrow> (x, a, b) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,a \<turnstile> Addr aa ::\<preceq> Class Ca))
 2. \<And>h a b aa x h' C lT T E Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class (fst (G, lT)) Ca; x = Some (Addr (XcptRef OutOfMemory))\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<and> Norm (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))), b) ::\<preceq> (G, lT) \<and> G,a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<turnstile> Addr aa ::\<preceq> Class Ca) \<and> ((\<exists>y. x = Some y) \<longrightarrow> (x, a, b) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,a \<turnstile> Addr aa ::\<preceq> Class Ca))
 3. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 4. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 5. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 6. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 7. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 8. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 9. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 10. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
A total of 16 subgoals...
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (16 subgoals):
 1. \<And>h a b aa x h' C lT T E Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class (fst (G, lT)) Ca; x = Some (Addr (XcptRef OutOfMemory))\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<and> Norm (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))), b) ::\<preceq> (G, lT) \<and> G,a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<turnstile> Addr aa ::\<preceq> Class Ca) \<and> ((\<exists>y. x = Some y) \<longrightarrow> (x, a, b) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,a \<turnstile> Addr aa ::\<preceq> Class Ca))
 2. \<And>h a b aa x h' C lT T E Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class (fst (G, lT)) Ca; a aa = None \<and> x = None\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<and> Norm (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))), b) ::\<preceq> (G, lT) \<and> G,a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<turnstile> Addr aa ::\<preceq> Class Ca) \<and> ((\<exists>y. x = Some y) \<longrightarrow> (x, a, b) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,a \<turnstile> Addr aa ::\<preceq> Class Ca))
 3. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 4. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 5. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 6. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 7. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 8. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 9. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 10. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
A total of 16 subgoals...
[PROOF STEP]
apply(  simp (no_asm_simp))
[PROOF STATE]
proof (prove)
goal (16 subgoals):
 1. \<And>a b x lT Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class (fst (G, lT)) Ca; x = Some (Addr (XcptRef OutOfMemory))\<rbrakk> \<Longrightarrow> (Some (Addr (XcptRef OutOfMemory)), a, b) ::\<preceq> (G, lT)
 2. \<And>h a b aa x h' C lT T E Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class (fst (G, lT)) Ca; a aa = None \<and> x = None\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<and> Norm (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))), b) ::\<preceq> (G, lT) \<and> G,a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<turnstile> Addr aa ::\<preceq> Class Ca) \<and> ((\<exists>y. x = Some y) \<longrightarrow> (x, a, b) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,a \<turnstile> Addr aa ::\<preceq> Class Ca))
 3. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 4. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 5. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 6. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 7. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 8. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 9. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 10. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
A total of 16 subgoals...
[PROOF STEP]
apply (rule conforms_xcpt_change, assumption)
[PROOF STATE]
proof (prove)
goal (16 subgoals):
 1. \<And>a b x lT Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class (fst (G, lT)) Ca; x = Some (Addr (XcptRef OutOfMemory))\<rbrakk> \<Longrightarrow> xconf a None \<longrightarrow> xconf a (Some (Addr (XcptRef OutOfMemory)))
 2. \<And>h a b aa x h' C lT T E Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class (fst (G, lT)) Ca; a aa = None \<and> x = None\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<and> Norm (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))), b) ::\<preceq> (G, lT) \<and> G,a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<turnstile> Addr aa ::\<preceq> Class Ca) \<and> ((\<exists>y. x = Some y) \<longrightarrow> (x, a, b) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,a \<turnstile> Addr aa ::\<preceq> Class Ca))
 3. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 4. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 5. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 6. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 7. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 8. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 9. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 10. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
A total of 16 subgoals...
[PROOF STEP]
apply (simp (no_asm_simp) add: xconf_def)
[PROOF STATE]
proof (prove)
goal (15 subgoals):
 1. \<And>h a b aa x h' C lT T E Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class (fst (G, lT)) Ca; a aa = None \<and> x = None\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<and> Norm (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))), b) ::\<preceq> (G, lT) \<and> G,a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<turnstile> Addr aa ::\<preceq> Class Ca) \<and> ((\<exists>y. x = Some y) \<longrightarrow> (x, a, b) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,a \<turnstile> Addr aa ::\<preceq> Class Ca))
 2. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 3. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 4. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 5. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 6. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 7. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 8. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 9. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 10. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> es [::] Ts \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) vs Ts)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
A total of 15 subgoals...
[PROOF STEP]
apply( clarsimp)
[PROOF STATE]
proof (prove)
goal (15 subgoals):
 1. \<And>a b aa lT Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class G Ca; a aa = None\<rbrakk> \<Longrightarrow> Norm (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))), b) ::\<preceq> (G, lT) \<and> G,a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<turnstile> Addr aa ::\<preceq> Class Ca
 2. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 3. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 4. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 5. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 6. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 7. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 8. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 9. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 10. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> es [::] Ts \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) vs Ts)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
A total of 15 subgoals...
[PROOF STEP]
apply( rule conjI)
[PROOF STATE]
proof (prove)
goal (16 subgoals):
 1. \<And>a b aa lT Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class G Ca; a aa = None\<rbrakk> \<Longrightarrow> Norm (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))), b) ::\<preceq> (G, lT)
 2. \<And>a b aa lT Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class G Ca; a aa = None\<rbrakk> \<Longrightarrow> G,a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<turnstile> Addr aa ::\<preceq> Class Ca
 3. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 4. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 5. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 6. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 7. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 8. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 9. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 10. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
A total of 16 subgoals...
[PROOF STEP]
apply(  force elim!: NewC_conforms)
[PROOF STATE]
proof (prove)
goal (15 subgoals):
 1. \<And>a b aa lT Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class G Ca; a aa = None\<rbrakk> \<Longrightarrow> G,a(aa \<mapsto> (Ca, init_vars (fields (G, Ca)))) \<turnstile> Addr aa ::\<preceq> Class Ca
 2. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 3. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 4. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 5. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 6. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 7. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 8. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 9. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 10. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> es [::] Ts \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) vs Ts)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
A total of 15 subgoals...
[PROOF STEP]
apply( rule conf_obj_AddrI)
[PROOF STATE]
proof (prove)
goal (16 subgoals):
 1. \<And>a b aa lT Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class G Ca; a aa = None\<rbrakk> \<Longrightarrow> (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca))))) aa = Some (?C207 a b aa lT Ca, ?fs207 a b aa lT Ca)
 2. \<And>a b aa lT Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class G Ca; a aa = None\<rbrakk> \<Longrightarrow> G \<turnstile> ?C207 a b aa lT Ca \<preceq>C Ca
 3. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 4. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 5. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 6. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 7. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 8. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 9. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 10. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
A total of 16 subgoals...
[PROOF STEP]
apply(  rule_tac [2] rtrancl.rtrancl_refl)
[PROOF STATE]
proof (prove)
goal (15 subgoals):
 1. \<And>a b aa lT Ca. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); is_class G Ca; a aa = None\<rbrakk> \<Longrightarrow> (a(aa \<mapsto> (Ca, init_vars (fields (G, Ca))))) aa = Some (Ca, ?fs207 a b aa lT Ca)
 2. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 3. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 4. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 5. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 6. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 7. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 8. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 9. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 10. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> es [::] Ts \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) vs Ts)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
A total of 15 subgoals...
[PROOF STEP]
apply( simp (no_asm))

\<comment> \<open>for Cast\<close>
[PROOF STATE]
proof (prove)
goal (14 subgoals):
 1. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 2. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 3. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 4. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 5. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 6. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 7. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 8. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 9. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> es [::] Ts \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) vs Ts)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 10. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
A total of 14 subgoals...
[PROOF STEP]
defer 1

\<comment> \<open>14 Lit\<close>
[PROOF STATE]
proof (prove)
goal (14 subgoals):
 1. \<And>a b v lT T x Ta E. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); typeof Map.empty x = Some Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> x ::\<preceq> Ta
 2. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 3. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 4. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 5. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 6. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 7. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 8. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> es [::] Ts \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) vs Ts)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 9. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 10. \<And>a b c1 aa ab ba c2 ac ad bb lT E s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> s1 \<surd> \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> c2 \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
A total of 14 subgoals...
[PROOF STEP]
apply( erule conf_litval)

\<comment> \<open>13 BinOp\<close>
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1a :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 2. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 3. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e :: T \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ab :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT)\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 5. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 6. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ag :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 7. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> es [::] Ts \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) vs Ts)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 8. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 9. \<And>a b c1 aa ab ba c2 ac ad bb lT E s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> s1 \<surd> \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> c2 \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ea :: T \<longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT) \<and> (aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T)); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
A total of 13 subgoals...
[PROOF STEP]
apply (tactic "forward_hyp_tac \<^context>")
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> Ta\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 2. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 3. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 5. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 6. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> ps [::] Ts \<longrightarrow> ab \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> list_all2 (conf G h) pvs Ts)); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 7. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>Ts. (G, lT) \<turnstile> es [::] Ts \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) vs Ts)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 8. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 9. \<And>a b c1 aa ab ba c2 ac ad bb lT E s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> c2 \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
A total of 13 subgoals...
[PROOF STEP]
apply (tactic "forward_hyp_tac \<^context>")
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> Ta; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> Ta\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 2. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 3. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 5. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 6. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 7. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 8. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 9. \<And>a b c1 aa ab ba c2 ac ad bb lT E s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
A total of 13 subgoals...
[PROOF STEP]
apply( rule conjI, erule (1) hext_trans)
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> Ta; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> Ta\<rbrakk> \<Longrightarrow> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T')
 2. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 3. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 5. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 6. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 7. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 8. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 9. \<And>a b c1 aa ab ba c2 ac ad bb lT E s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
A total of 13 subgoals...
[PROOF STEP]
apply( erule conjI)
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. \<And>a b e1 v1 aa ab ba e2 v2 ac ad bb v bop lT T E e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> Ta; ab \<le>| ad; ac = None \<longrightarrow> G,ad \<turnstile> v2 ::\<preceq> Ta\<rbrakk> \<Longrightarrow> ac = None \<longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T'
 2. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 3. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 5. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 6. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 7. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 8. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 9. \<And>a b c1 aa ab ba c2 ac ad bb lT E s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
A total of 13 subgoals...
[PROOF STEP]
apply( clarsimp)
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. \<And>a b v1 aa ab ba e2 v2 ad bb bop lT e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -e2\<succ>v2-> Norm (ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> Ta; ab \<le>| ad; G,ad \<turnstile> v2 ::\<preceq> Ta\<rbrakk> \<Longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T'
 2. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 3. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 5. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 6. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 7. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 8. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 9. \<And>a b c1 aa ab ba c2 ac ad bb lT E s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
A total of 13 subgoals...
[PROOF STEP]
apply( drule eval_no_xcpt)
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. \<And>a b v1 aa ab ba e2 v2 ad bb bop lT e1a Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1a\<succ>v1-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e1a :: Ta; (G, lT) \<turnstile> e2 :: Ta; if bop = Eq then T' = PrimT Boolean else T' = Ta \<and> Ta = PrimT Integer; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v1 ::\<preceq> Ta; ab \<le>| ad; G,ad \<turnstile> v2 ::\<preceq> Ta; aa = None\<rbrakk> \<Longrightarrow> G,ad \<turnstile> (case bop of Eq \<Rightarrow> Bool (v1 = v2) | Add \<Rightarrow> Intg (the_Intg v1 + the_Intg v2)) ::\<preceq> T'
 2. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 3. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 5. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 6. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 7. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 8. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 9. \<And>a b c1 aa ab ba c2 ac ad bb lT E s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
A total of 13 subgoals...
[PROOF STEP]
apply( simp split: binop.split)

\<comment> \<open>12 LAcc\<close>
[PROOF STATE]
proof (prove)
goal (12 subgoals):
 1. \<And>a b v lT T E va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); snd (G, lT) va = Some Ta; is_type (fst (G, lT)) Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 2. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 3. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 4. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 5. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 6. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 7. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 8. \<And>a b c1 aa ab ba c2 ac ad bb lT E s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 9. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<not> the_Bool v; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
A total of 12 subgoals...
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (12 subgoals):
 1. \<And>a b lT va Ta. \<lbrakk>wf_java_prog G; Norm (a, b) ::\<preceq> (G, lT); lT va = Some Ta; is_type G Ta\<rbrakk> \<Longrightarrow> G,a \<turnstile> the (b va) ::\<preceq> Ta
 2. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 3. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 4. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 5. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 6. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 7. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 8. \<And>a b c1 aa ab ba c2 ac ad bb lT E s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 9. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<not> the_Bool v; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
A total of 12 subgoals...
[PROOF STEP]
apply( fast elim: conforms_localD [THEN lconfD])

\<comment> \<open>for FAss\<close>
[PROOF STATE]
proof (prove)
goal (11 subgoals):
 1. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 2. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b e1 a' x1 aa ba ab e2 v x2 ac bb h c fs h' fn T lT Ta E fd Tb T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e1\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e1 :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> {fd}e1..fn :: Tb; (G, lT) \<turnstile> e2 :: T'; fst (G, lT) \<turnstile> T' \<preceq> Tb\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 6. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 7. \<And>a b c1 aa ab ba c2 ac ad bb lT E s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 8. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 9. \<And>a b e v aa ab ba c lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<not> the_Bool v; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c ac ad bb ae af bc lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
A total of 11 subgoals...
[PROOF STEP]
apply( tactic \<open>EVERY'[eresolve_tac \<^context> [@{thm ty_expr.cases}, @{thm ty_exprs.cases}, @{thm wt_stmt.cases}]
       THEN_ALL_NEW (full_simp_tac \<^context>), REPEAT o (eresolve_tac \<^context> [conjE]), hyp_subst_tac \<^context>] 3\<close>)

\<comment> \<open>for if\<close>
[PROOF STATE]
proof (prove)
goal (11 subgoals):
 1. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 2. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b e1 a' x1 aa ba e2 v x2 ac bb c fs fn lT fd Tb T' Ea ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ad :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (fst (G, lT), C) fn = Some (fd, fT)\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 6. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 7. \<And>a b c1 aa ab ba c2 ac ad bb lT E s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 8. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 9. \<And>a b e v aa ab ba c lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<not> the_Bool v; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c ac ad bb ae af bc lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
A total of 11 subgoals...
[PROOF STEP]
apply( tactic \<open>(Induct_Tacs.case_tac \<^context> "the_Bool v" [] NONE THEN_ALL_NEW
  (asm_full_simp_tac \<^context>)) 7\<close>)
[PROOF STATE]
proof (prove)
goal (12 subgoals):
 1. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 2. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b e1 a' x1 aa ba e2 v x2 ac bb c fs fn lT fd Tb T' Ea ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); \<forall>lT. Norm (a, b) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> ad :: T \<longrightarrow> a \<le>| aa \<and> (x1, aa, ba) ::\<preceq> (G, lT) \<and> (x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> T)); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (fst (G, lT), C) fn = Some (fd, fT)\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 6. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 7. \<And>a b aa ab ba c2 ac ad bb lT s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad
 8. \<And>a b aa ab ba c2 ac ad bb lT s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); \<not> the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad
 9. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<not> the_Bool v; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
A total of 12 subgoals...
[PROOF STEP]
apply (tactic "forward_hyp_tac \<^context>")

\<comment> \<open>11+1 if\<close>
[PROOF STATE]
proof (prove)
goal (12 subgoals):
 1. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 2. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b e1 a' x1 aa ba e2 v x2 ac bb c fs fn lT fd Tb T' Ea ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (fst (G, lT), C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 6. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 7. \<And>a b aa ab ba c2 ac ad bb lT s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad
 8. \<And>a b aa ab ba c2 ac ad bb lT s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); \<not> the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad
 9. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<not> the_Bool v; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
A total of 12 subgoals...
[PROOF STEP]
prefer 7
[PROOF STATE]
proof (prove)
goal (12 subgoals):
 1. \<And>a b aa ab ba c2 ac ad bb lT s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad
 2. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 3. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 4. \<And>a b e1 a' x1 aa ba e2 v x2 ac bb c fs fn lT fd Tb T' Ea ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (fst (G, lT), C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 5. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 6. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 7. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 8. \<And>a b aa ab ba c2 ac ad bb lT s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); \<not> the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad
 9. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<not> the_Bool v; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
A total of 12 subgoals...
[PROOF STEP]
apply(  fast intro: hext_trans)
[PROOF STATE]
proof (prove)
goal (11 subgoals):
 1. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 2. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b e1 a' x1 aa ba e2 v x2 ac bb c fs fn lT fd Tb T' Ea ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (fst (G, lT), C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 6. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 7. \<And>a b aa ab ba c2 ac ad bb lT s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); \<not> the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad
 8. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 9. \<And>a b e v aa ab ba c lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<not> the_Bool v; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c ac ad bb ae af bc lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
A total of 11 subgoals...
[PROOF STEP]
prefer 7
[PROOF STATE]
proof (prove)
goal (11 subgoals):
 1. \<And>a b aa ab ba c2 ac ad bb lT s1. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -s1-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> s1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); \<not> the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad
 2. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 3. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 4. \<And>a b e1 a' x1 aa ba e2 v x2 ac bb c fs fn lT fd Tb T' Ea ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (fst (G, lT), C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 5. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 6. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 7. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 8. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 9. \<And>a b e v aa ab ba c lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<not> the_Bool v; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 10. \<And>a b e v aa ab ba c ac ad bb ae af bc lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
A total of 11 subgoals...
[PROOF STEP]
apply(  fast intro: hext_trans)

\<comment> \<open>10 Expr\<close>
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 2. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b e1 a' x1 aa ba e2 v x2 ac bb c fs fn lT fd Tb T' Ea ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (fst (G, lT), C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 6. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 7. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 8. \<And>a b e v aa ab ba c lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<not> the_Bool v; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 9. \<And>a b e v aa ab ba c ac ad bb ae af bc lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
 10. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Ca\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
[PROOF STEP]
prefer 6
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. \<And>a b e v aa ab ba lT E ea T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 2. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 3. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 4. \<And>a b e1 a' x1 aa ba e2 v x2 ac bb c fs fn lT fd Tb T' Ea ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (fst (G, lT), C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 5. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 6. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 7. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 8. \<And>a b e v aa ab ba c lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<not> the_Bool v; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 9. \<And>a b e v aa ab ba c ac ad bb ae af bc lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
 10. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Ca\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
[PROOF STEP]
apply( fast)

\<comment> \<open>9 ???\<close>
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<And>a b e v x h l l' va lT T vb E Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; fst (G, lT) \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x = None \<longrightarrow> a \<le>| h \<and> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT) \<and> G,h \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x = Some y) \<longrightarrow> a \<le>| h \<and> (x, h, l) ::\<preceq> (G, lT) \<and> (x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'))
 2. \<And>a b e a' x1 aa ba v fn T lT Ta E ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (fst (G, lT), C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b e1 a' x1 aa ba e2 v x2 ac bb c fs fn lT fd Tb T' Ea ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (fst (G, lT), C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b e a' aa ab ba ac ps pvs x h l dynT md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT T E ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec (fst (G, lT)) C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b e v aa ab ba es vs ac ad bb lT Ts E ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT) \<and> (ac = None \<longrightarrow> list_all2 (conf G ad) (v # vs) (T # Tsa))
 6. \<And>a b e v aa ab ba c1 c2 ac ad bb lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 7. \<And>a b e v aa ab ba c lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); \<not> the_Bool v; Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ab \<and> (aa, ab, ba) ::\<preceq> (G, lT)
 8. \<And>a b e v aa ab ba c ac ad bb ae af bc lT E ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
 9. \<And>a b e v x1 aa ba x2 C lT T E ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class (fst (G, lT)) C; fst (G, lT) \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Ca\<rbrakk> \<Longrightarrow> a \<le>| aa \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
[PROOF STEP]
apply( simp_all)

\<comment> \<open>8 Cast\<close>
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>a b e v x h l lT vb Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; G \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> x = None \<longrightarrow> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 6. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 7. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
 8. \<And>a b v x1 aa ba C lT ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class G C; G \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Ca\<rbrakk> \<Longrightarrow> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
[PROOF STEP]
prefer 8
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>a b v x1 aa ba C lT ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class G C; G \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Ca\<rbrakk> \<Longrightarrow> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT) \<and> (raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C)
 2. \<And>a b e v x h l lT vb Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; G \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> x = None \<longrightarrow> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT)
 3. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 4. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 5. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 6. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 7. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 8. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply (rule conjI)
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<And>a b v x1 aa ba C lT ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class G C; G \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Ca\<rbrakk> \<Longrightarrow> (raise_if (\<not> cast_ok G C aa v) ClassCast x1, aa, ba) ::\<preceq> (G, lT)
 2. \<And>a b v x1 aa ba C lT ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class G C; G \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Ca\<rbrakk> \<Longrightarrow> raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C
 3. \<And>a b e v x h l lT vb Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; G \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> x = None \<longrightarrow> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT)
 4. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 5. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 6. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 7. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 8. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 9. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply (fast intro: conforms_xcpt_change xconf_raise_if)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>a b v x1 aa ba C lT ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class G C; G \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Ca\<rbrakk> \<Longrightarrow> raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C
 2. \<And>a b e v x h l lT vb Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; G \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> x = None \<longrightarrow> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT)
 3. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 4. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 5. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 6. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 7. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 8. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>a b v x1 aa ba C lT ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class G C; G \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Ca; raise_if (\<not> cast_ok G C aa v) ClassCast x1 = None\<rbrakk> \<Longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C
 2. \<And>a b e v x h l lT vb Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; G \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> x = None \<longrightarrow> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT)
 3. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 4. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 5. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 6. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 7. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 8. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply (drule raise_if_NoneD)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>a b v x1 aa ba C lT ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class G C; G \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> v ::\<preceq> Ca; \<not> \<not> cast_ok G C aa v \<and> x1 = None\<rbrakk> \<Longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C
 2. \<And>a b e v x h l lT vb Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; G \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> x = None \<longrightarrow> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT)
 3. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 4. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 5. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 6. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 7. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 8. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply (clarsimp)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>a b v aa ba C lT ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> Norm (aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class G C; G \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; Norm (aa, ba) ::\<preceq> (G, lT); G,aa \<turnstile> v ::\<preceq> Ca; cast_ok G C aa v\<rbrakk> \<Longrightarrow> G,aa \<turnstile> v ::\<preceq> Class C
 2. \<And>a b e v x h l lT vb Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; G \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> x = None \<longrightarrow> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT)
 3. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 4. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 5. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 6. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 7. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 8. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply (rule Cast_conf)
[PROOF STATE]
proof (prove)
goal (11 subgoals):
 1. \<And>a b v aa ba C lT ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> Norm (aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class G C; G \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; Norm (aa, ba) ::\<preceq> (G, lT); G,aa \<turnstile> v ::\<preceq> Ca; cast_ok G C aa v\<rbrakk> \<Longrightarrow> wf_prog (?wf_mb367 a b v aa ba C lT ea Ca) G
 2. \<And>a b v aa ba C lT ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> Norm (aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class G C; G \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; Norm (aa, ba) ::\<preceq> (G, lT); G,aa \<turnstile> v ::\<preceq> Ca; cast_ok G C aa v\<rbrakk> \<Longrightarrow> G,aa \<turnstile> v ::\<preceq> ?CC367 a b v aa ba C lT ea Ca
 3. \<And>a b v aa ba C lT ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> Norm (aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class G C; G \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; Norm (aa, ba) ::\<preceq> (G, lT); G,aa \<turnstile> v ::\<preceq> Ca; cast_ok G C aa v\<rbrakk> \<Longrightarrow> G \<turnstile> ?CC367 a b v aa ba C lT ea Ca \<preceq>? Class C
 4. \<And>a b v aa ba C lT ea Ca. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> Norm (aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: Ca; is_class G C; G \<turnstile> Ca \<preceq>? Class C; a \<le>| aa; Norm (aa, ba) ::\<preceq> (G, lT); G,aa \<turnstile> v ::\<preceq> Ca; cast_ok G C aa v\<rbrakk> \<Longrightarrow> cast_ok G C aa v
 5. \<And>a b e v x h l lT vb Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; G \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> x = None \<longrightarrow> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT)
 6. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 7. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 8. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 9. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 10. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
A total of 11 subgoals...
[PROOF STEP]
apply assumption+

\<comment> \<open>7 LAss\<close>
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>a b e v x h l lT vb Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; G \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> x = None \<longrightarrow> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, \<lambda>a. if a = This then Some a' else (init_vars lvars(pns [\<mapsto>] pvs)) a) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 6. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 7. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply (fold fun_upd_def)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>a b e v x h l lT vb Ta T'. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> LAcc vb :: Ta; (G, lT) \<turnstile> e :: T'; G \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> x = None \<longrightarrow> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 6. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 7. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply( tactic \<open>(eresolve_tac \<^context> [@{thm ty_expr.cases}, @{thm ty_exprs.cases}, @{thm wt_stmt.cases}]
                 THEN_ALL_NEW (full_simp_tac \<^context>)) 1\<close>)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>a b e v x h l lT vb Ta T' E va T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> e :: T'; G \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'; (G, lT) = E; vb = va; Ta = T; snd E va = Some T; is_type (fst E) T\<rbrakk> \<Longrightarrow> x = None \<longrightarrow> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 6. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 7. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply (intro strip)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>a b e v x h l lT vb Ta T' E va T. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> e :: T'; G \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'; (G, lT) = E; vb = va; Ta = T; snd E va = Some T; is_type (fst E) T; x = None\<rbrakk> \<Longrightarrow> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 6. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 7. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply (case_tac E)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>a b e v x h l lT vb Ta T' E va T aa ba. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -e\<succ>v-> (x, h, l); Norm (a, b) ::\<preceq> (G, lT); vb \<noteq> This; (G, lT) \<turnstile> e :: T'; G \<turnstile> T' \<preceq> Ta; a \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> G,h \<turnstile> v ::\<preceq> T'; (G, lT) = E; vb = va; Ta = T; snd E va = Some T; is_type (fst E) T; x = None; E = (aa, ba)\<rbrakk> \<Longrightarrow> Norm (h, l(vb \<mapsto> v)) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 6. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 7. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply (simp)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>a b e v x h l lT vb Ta T' E va T aa. \<lbrakk>wf_java_prog aa; aa \<turnstile> Norm (a, b) -e\<succ>v-> Norm (h, l); Norm (a, b) ::\<preceq> (aa, lT); va \<noteq> This; (aa, lT) \<turnstile> e :: T'; aa \<turnstile> T' \<preceq> T; a \<le>| h; Norm (h, l) ::\<preceq> (aa, lT); aa,h \<turnstile> v ::\<preceq> T'; G = aa; vb = va; Ta = T; lT va = Some T; is_type aa T; x = None; E = (aa, lT)\<rbrakk> \<Longrightarrow> Norm (h, l(va \<mapsto> v)) ::\<preceq> (aa, lT)
 2. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 3. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 6. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 7. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply( blast intro: conforms_upd_local conf_widen)

\<comment> \<open>6 FAcc\<close>
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT) \<and> (np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT)
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 4. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 5. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 6. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply (rule conjI)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT
 3. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 6. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 7. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply (simp add: np_def)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (raise_if (a' = Null) NullPointer x1, aa, ba) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT
 3. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 6. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 7. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply (fast intro: conforms_xcpt_change xconf_raise_if)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>a b a' x1 aa ba fn T lT ab C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ab\<succ>a'-> (x1, aa, ba); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ab :: Class C; field (G, C) fn = Some (T, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> np a' x1 = None \<longrightarrow> G,aa \<turnstile> the (snd (the (aa (the_Addr a'))) (fn, T)) ::\<preceq> fT
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 4. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 5. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 6. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
apply( fast elim!: FAcc_type_sound)

\<comment> \<open>5 While\<close>
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 3. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 4. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 5. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
[PROOF STEP]
prefer 5
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 4. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 5. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
[PROOF STEP]
apply(erule_tac V = "a \<longrightarrow> b" for a b in thin_rl)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 4. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 5. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
[PROOF STEP]
apply(drule (1) ty_expr_ty_exprs_wt_stmt.Loop)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b v aa ab ba c ac ad bb ae af bc lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); the_Bool v; G \<turnstile> (aa, ab, ba) -c-> (ac, ad, bb); G \<turnstile> (ac, ad, bb) -While (ea) c-> (ae, af, bc); \<forall>lT. (ac, ad, bb) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> While (ea) c \<surd> \<longrightarrow> ad \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> c \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); (G, lT) \<turnstile> While (ea) c \<surd>\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (ae, af, bc) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 4. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 5. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
[PROOF STEP]
apply(force elim: hext_trans)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 3. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 4. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
[PROOF STEP]
apply (tactic "forward_hyp_tac \<^context>")

\<comment> \<open>4 Cond\<close>
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 3. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 4. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
[PROOF STEP]
prefer 4
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 4. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
[PROOF STEP]
apply (case_tac "the_Bool v")
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 2. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; \<not> the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 3. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c1-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> c1 \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad
 2. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; \<not> the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 3. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 4. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 5. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
[PROOF STEP]
apply( fast dest: evals_no_xcpt intro: conf_hext hext_trans)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -(if the_Bool v then c1 else c2)-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> (if the_Bool v then c1 else c2) \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; \<not> the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 4. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>a b v aa ab ba c1 c2 ac ad bb lT ea. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -c2-> (ac, ad, bb); \<forall>lT. (aa, ab, ba) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> c2 \<surd> \<longrightarrow> ab \<le>| ad \<and> (ac, ad, bb) ::\<preceq> (G, lT); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: PrimT Boolean; (G, lT) \<turnstile> c1 \<surd>; (G, lT) \<turnstile> c2 \<surd>; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> PrimT Boolean; \<not> the_Bool v\<rbrakk> \<Longrightarrow> a \<le>| ad
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 4. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
[PROOF STEP]
apply( fast dest: evals_no_xcpt intro: conf_hext hext_trans)

\<comment> \<open>3 ;;\<close>
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 3. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
[PROOF STEP]
prefer 3
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b v aa ab ba es vs ac ad bb lT ea T Tsa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ea\<succ>v-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -es[\<succ>]vs-> (ac, ad, bb); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ea :: T; (G, lT) \<turnstile> es [::] Tsa; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> v ::\<preceq> T; ab \<le>| ad; (ac, ad, bb) ::\<preceq> (G, lT); ac = None \<longrightarrow> list_all2 (conf G ad) vs Tsa\<rbrakk> \<Longrightarrow> a \<le>| ad \<and> (ac = None \<longrightarrow> G,ad \<turnstile> v ::\<preceq> T)
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply( fast dest: evals_no_xcpt intro: conf_hext hext_trans)

\<comment> \<open>2 FAss\<close>
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply (subgoal_tac "(np a' x1, aa, ba) ::\<preceq> (G, lT)")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT)
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (np a' x1, aa, ba) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply (simp add: np_def)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (raise_if (a' = Null) NullPointer x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (raise_if (a' = Null) NullPointer x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C\<rbrakk> \<Longrightarrow> (raise_if (a' = Null) NullPointer x1, aa, ba) ::\<preceq> (G, lT)
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply (fast intro: conforms_xcpt_change xconf_raise_if)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply( case_tac "x2")
  \<comment> \<open>x2 = None\<close>
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT); x2 = None\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT ab. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT); x2 = Some ab\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply (simp)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> Norm (ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> Norm (ac, bb) ::\<preceq> (G, lT) \<and> G,ac \<turnstile> v ::\<preceq> T); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT); x2 = None\<rbrakk> \<Longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T'
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT ab. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); \<forall>lT. (np a' x1, aa, ba) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> e2 :: T \<longrightarrow> aa \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T)); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT); x2 = Some ab\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply (tactic "forward_hyp_tac \<^context>", clarify)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> Norm (ac, bb); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT); aa \<le>| ac; Norm (ac, bb) ::\<preceq> (G, lT); G,ac \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T'
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT ab. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT); x2 = Some ab; aa \<le>| ac; (x2, ac, bb) ::\<preceq> (G, lT); x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply( drule eval_no_xcpt)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT); aa \<le>| ac; Norm (ac, bb) ::\<preceq> (G, lT); G,ac \<turnstile> v ::\<preceq> T'; np a' x1 = None\<rbrakk> \<Longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T'
 2. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT ab. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT); x2 = Some ab; aa \<le>| ac; (x2, ac, bb) ::\<preceq> (G, lT); x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 3. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply( erule FAss_type_sound, rule HOL.refl, assumption+)
  \<comment> \<open>x2 = Some a\<close>
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT ab. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT); x2 = Some ab; aa \<le>| ac; (x2, ac, bb) ::\<preceq> (G, lT); x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> (x2 = None \<longrightarrow> a \<le>| ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<and> Norm (ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))), bb) ::\<preceq> (G, lT) \<and> G,ac(the_Addr a' \<mapsto> (c, fs((fn, fd) \<mapsto> v))) \<turnstile> v ::\<preceq> T') \<and> ((\<exists>y. x2 = Some y) \<longrightarrow> a \<le>| ac \<and> (x2, ac, bb) ::\<preceq> (G, lT) \<and> (x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'))
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply (  simp (no_asm_simp))
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' x1 aa ba e2 v x2 ac bb c fs fn lT fd T' ad C fT ab. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ad\<succ>a'-> (x1, aa, ba); G \<turnstile> (np a' x1, aa, ba) -e2\<succ>v-> (x2, ac, bb); (c, fs) = the (ac (the_Addr a')); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> e2 :: T'; G \<turnstile> T' \<preceq> fT; (G, lT) \<turnstile> ad :: Class C; field (G, C) fn = Some (fd, fT); a \<le>| aa; (x1, aa, ba) ::\<preceq> (G, lT); x1 = None \<longrightarrow> G,aa \<turnstile> a' ::\<preceq> Class C; (np a' x1, aa, ba) ::\<preceq> (G, lT); x2 = Some ab; aa \<le>| ac; (x2, ac, bb) ::\<preceq> (G, lT); x2 = None \<longrightarrow> G,ac \<turnstile> v ::\<preceq> T'\<rbrakk> \<Longrightarrow> a \<le>| ac \<and> (Some ab, ac, bb) ::\<preceq> (G, lT)
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(  fast intro: hext_trans)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply( tactic "prune_params_tac \<^context>")
\<comment> \<open>Level 52\<close>

\<comment> \<open>1 Call\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply( case_tac "x")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa; x = None\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa ac. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa; x = Some ac\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
prefer 2
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa ac. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa; x = Some ac\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa; x = None\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(  clarsimp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa ac. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (Some ac, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (Some ac, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (Some ac, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (Some ac, h, l) ::\<preceq> (G, lT)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa; x = None\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(  drule exec_xcpt)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa ac. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (Some ac, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); \<forall>lT. (Some ac, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (Some ac, h, l) ::\<preceq> (G, lT); ad = Some ac \<and> (ae, bb) = (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a'))\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa; x = None\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(  simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad v x4 af bc C lT ag pTsa mda rTa ac. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (Some ac, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (Some ac, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -res\<succ>v-> (x4, af, bc); \<forall>lT. (Some ac, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> h \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (Some ac, h, l) ::\<preceq> (G, lT); ad = Some ac\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa; x = None\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(  drule_tac eval_xcpt)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad v x4 af bc C lT ag pTsa mda rTa ac. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (Some ac, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); \<forall>lT. (Some ac, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> h \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (Some ac, h, l) ::\<preceq> (G, lT); ad = Some ac; x4 = Some ac \<and> (af, bc) = (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a'))\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa; x = None\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(  simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad x4 C lT ag pTsa mda rTa ac. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (Some ac, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (Some ac, h, l) ::\<preceq> (G, lT); ad = Some ac; x4 = Some ac\<rbrakk> \<Longrightarrow> a \<le>| h
 2. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa; x = None\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(  fast elim: hext_trans)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> (x, h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' x, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; (x, h, l) ::\<preceq> (G, lT); x = None \<longrightarrow> list_all2 (conf G h) pvs pTsa; x = None\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply( clarify)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); G \<turnstile> (aa, ab, ba) -ps[\<succ>]pvs-> Norm (h, l); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); None = None \<longrightarrow> list_all2 (conf G h) pvs pTsa\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply( drule evals_no_xcpt)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b a' aa ab ba ps pvs x h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> (aa, ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; (aa, ab, ba) ::\<preceq> (G, lT); aa = None \<longrightarrow> G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); None = None \<longrightarrow> list_all2 (conf G h) pvs pTsa; aa = None\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply( simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply( case_tac "a' = Null")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' = Null\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 2. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' \<noteq> Null\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(  simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>Null-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h Null) (mn, pTs)); G \<turnstile> (Some (Addr (XcptRef NullPointer)), h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> Null)) -blk-> (ad, ae, bb); \<forall>lT. (Some (Addr (XcptRef NullPointer)), h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> Null)) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' = Null\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 2. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' \<noteq> Null\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(  drule exec_xcpt)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>Null-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h Null) (mn, pTs)); \<forall>lT. (Some (Addr (XcptRef NullPointer)), h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> Null)) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' = Null; ad = Some (Addr (XcptRef NullPointer)) \<and> (ae, bb) = (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> Null))\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 2. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' \<noteq> Null\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(  simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>Null-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h Null) (mn, pTs)); G \<turnstile> (Some (Addr (XcptRef NullPointer)), h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> Null)) -res\<succ>v-> (x4, af, bc); \<forall>lT. (Some (Addr (XcptRef NullPointer)), h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> Null)) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> h \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' = Null; ad = Some (Addr (XcptRef NullPointer))\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 2. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' \<noteq> Null\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(  drule eval_xcpt)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>Null-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h Null) (mn, pTs)); \<forall>lT. (Some (Addr (XcptRef NullPointer)), h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> Null)) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> h \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' = Null; ad = Some (Addr (XcptRef NullPointer)); x4 = Some (Addr (XcptRef NullPointer)) \<and> (af, bc) = (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> Null))\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
 2. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' \<noteq> Null\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(  simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad x4 C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>Null-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h Null) (mn, pTs)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' = Null; ad = Some (Addr (XcptRef NullPointer)); x4 = Some (Addr (XcptRef NullPointer))\<rbrakk> \<Longrightarrow> a \<le>| h \<and> (Some (Addr (XcptRef NullPointer)), h, l) ::\<preceq> (G, lT)
 2. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' \<noteq> Null\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply (rule conjI)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad x4 C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>Null-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h Null) (mn, pTs)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' = Null; ad = Some (Addr (XcptRef NullPointer)); x4 = Some (Addr (XcptRef NullPointer))\<rbrakk> \<Longrightarrow> a \<le>| h
 2. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad x4 C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>Null-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h Null) (mn, pTs)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' = Null; ad = Some (Addr (XcptRef NullPointer)); x4 = Some (Addr (XcptRef NullPointer))\<rbrakk> \<Longrightarrow> (Some (Addr (XcptRef NullPointer)), h, l) ::\<preceq> (G, lT)
 3. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' \<noteq> Null\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(  fast elim: hext_trans)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad x4 C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>Null-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h Null) (mn, pTs)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' = Null; ad = Some (Addr (XcptRef NullPointer)); x4 = Some (Addr (XcptRef NullPointer))\<rbrakk> \<Longrightarrow> (Some (Addr (XcptRef NullPointer)), h, l) ::\<preceq> (G, lT)
 2. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' \<noteq> Null\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply (rule conforms_xcpt_change, assumption)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad x4 C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>Null-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h Null) (mn, pTs)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' = Null; ad = Some (Addr (XcptRef NullPointer)); x4 = Some (Addr (XcptRef NullPointer))\<rbrakk> \<Longrightarrow> xconf h None \<longrightarrow> xconf h (Some (Addr (XcptRef NullPointer)))
 2. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' \<noteq> Null\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply (simp (no_asm_simp) add: xconf_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b a' aa ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. (np a' None, h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; aa = None; a' \<noteq> Null\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(clarsimp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ag :: Class C; (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply( drule ty_expr_is_type, simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; is_type (fst (G, lT)) (Class C)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(clarsimp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; is_class G C\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(unfold is_class_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C \<noteq> None\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(clarsimp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> a \<le>| af \<and> (x4, af, l) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> rTa)
[PROOF STEP]
apply(rule Call_type_sound)
[PROOF STATE]
proof (prove)
goal (12 subgoals):
 1. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> wf_java_prog G
 2. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> ?a'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd \<noteq> Null
 3. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> Norm (?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, l) ::\<preceq> (G, lT)
 4. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> class G (?C809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) = Some (?y809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)
 5. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> max_spec G (?C809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) (?mn809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?pTsa809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) = {((?mda809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, rTa), ?pTs'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)}
 6. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> a \<le>| ?xh809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd
 7. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> ?xh809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd \<le>| ?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd
 8. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> list_all2 (conf G (?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)) (?pvs809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) (?pTsa809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)
 9. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> (?md809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?rT809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?pns809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?lvars809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?blk809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?res809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) = the (method (G, cname_of (?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) (?a'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)) (?mn809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?pTs'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd))
 10. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> \<forall>lTa. (np (?a'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) None, ?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, init_vars (?lvars809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)(?pns809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd [\<mapsto>] ?pvs809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, This \<mapsto> ?a'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)) ::\<preceq> (G, lTa) \<longrightarrow> (G, lTa) \<turnstile> ?blk809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd \<surd> \<longrightarrow> ?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd \<le>| ?xi809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd \<and> (?xcptb809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?xi809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?xl809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) ::\<preceq> (G, lTa)
A total of 12 subgoals...
[PROOF STEP]
prefer 11
[PROOF STATE]
proof (prove)
goal (12 subgoals):
 1. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> \<forall>lTa. (?xcptb809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?xi809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?xl809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) ::\<preceq> (G, lTa) \<longrightarrow> (\<forall>T. (G, lTa) \<turnstile> ?res809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd :: T \<longrightarrow> ?xi809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd \<le>| af \<and> (x4, af, ?xj809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) ::\<preceq> (G, lTa) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T))
 2. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> wf_java_prog G
 3. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> ?a'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd \<noteq> Null
 4. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> Norm (?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, l) ::\<preceq> (G, lT)
 5. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> class G (?C809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) = Some (?y809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)
 6. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> max_spec G (?C809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) (?mn809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?pTsa809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) = {((?mda809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, rTa), ?pTs'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)}
 7. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> a \<le>| ?xh809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd
 8. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> ?xh809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd \<le>| ?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd
 9. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> list_all2 (conf G (?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)) (?pvs809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) (?pTsa809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)
 10. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> (?md809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?rT809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?pns809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?lvars809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?blk809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?res809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) = the (method (G, cname_of (?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) (?a'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)) (?mn809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?pTs'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd))
A total of 12 subgoals...
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (11 subgoals):
 1. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> wf_java_prog G
 2. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> ?a'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd \<noteq> Null
 3. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> Norm (?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, l) ::\<preceq> (G, lT)
 4. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> class G (?C809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) = Some (?y809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)
 5. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> max_spec G (?C809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) (?mn809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?pTsa809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) = {((?mda809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, rTa), ?pTs'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)}
 6. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> a \<le>| ?xh809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd
 7. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> ?xh809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd \<le>| ?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd
 8. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> list_all2 (conf G (?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)) (?pvs809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) (?pTsa809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)
 9. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> (?md809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?rT809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?pns809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?lvars809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?blk809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, res) = the (method (G, cname_of (?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) (?a'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)) (?mn809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, ?pTs'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd))
 10. \<And>a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd. \<lbrakk>wf_java_prog G; G \<turnstile> Norm (a, b) -ag\<succ>a'-> Norm (ab, ba); (md, rT, pns, lvars, blk, res) = the (method (G, cname_of h a') (mn, pTs)); G \<turnstile> Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) -blk-> (ad, ae, bb); \<forall>lT. Norm (h, init_vars lvars(pns [\<mapsto>] pvs, This \<mapsto> a')) ::\<preceq> (G, lT) \<longrightarrow> (G, lT) \<turnstile> blk \<surd> \<longrightarrow> h \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lT); G \<turnstile> (ad, ae, bb) -res\<succ>v-> (x4, af, bc); \<forall>lT. (ad, ae, bb) ::\<preceq> (G, lT) \<longrightarrow> (\<forall>T. (G, lT) \<turnstile> res :: T \<longrightarrow> ae \<le>| af \<and> (x4, af, bc) ::\<preceq> (G, lT) \<and> (x4 = None \<longrightarrow> G,af \<turnstile> v ::\<preceq> T)); Norm (a, b) ::\<preceq> (G, lT); (G, lT) \<turnstile> ps [::] pTsa; max_spec G C (mn, pTsa) = {((mda, rTa), pTs)}; a \<le>| ab; Norm (ab, ba) ::\<preceq> (G, lT); G,ab \<turnstile> a' ::\<preceq> Class C; ab \<le>| h; Norm (h, l) ::\<preceq> (G, lT); list_all2 (conf G h) pvs pTsa; a' \<noteq> Null; class G C = Some (aa, ac, bd)\<rbrakk> \<Longrightarrow> \<forall>lTa. (np (?a'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd) None, ?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, init_vars (?lvars809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)(?pns809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd [\<mapsto>] ?pvs809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd, This \<mapsto> ?a'809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd)) ::\<preceq> (G, lTa) \<longrightarrow> (G, lTa) \<turnstile> ?blk809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd \<surd> \<longrightarrow> ?h809 a b a' ab ba ps pvs h l md rT pns lvars blk res mn pTs ad ae bb v x4 af bc C lT ag pTsa mda rTa aa ac bd \<le>| ae \<and> (ad, ae, bb) ::\<preceq> (G, lTa)
A total of 11 subgoals...
[PROOF STEP]
apply (simp (no_asm_simp))+
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done