[STATEMENT]
lemma store_cond_cap_bounds:
  assumes "store h c val = Success h'"
    and "val = Cap_v x"
shows "\<exists> m. Mapping.lookup (heap_map h) (block_id c) = Some (Map m)
          \<and> offset c \<ge> fst (bounds m)
          \<and> offset c + |memval_type val|\<^sub>\<tau> \<le> snd (bounds m)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>m. Mapping.lookup (heap_map h) (block_id c) = Some (Map m) \<and> int (fst (bounds m)) \<le> offset c \<and> offset c + int |memval_type val|\<^sub>\<tau> \<le> int (snd (bounds m))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>m. Mapping.lookup (heap_map h) (block_id c) = Some (Map m) \<and> int (fst (bounds m)) \<le> offset c \<and> offset c + int |memval_type val|\<^sub>\<tau> \<le> int (snd (bounds m))
[PROOF STEP]
have cap_perms: "\<not>(\<not> perm_cap_store c \<and> tag x) \<and> \<not>(\<not> perm_cap_store_local c \<and> tag x \<and> \<not> perm_global x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> (\<not> perm_cap_store c \<and> tag x) \<and> \<not> (\<not> perm_cap_store_local c \<and> tag x \<and> \<not> perm_global x)
[PROOF STEP]
using store_cond_hard_cap(1)[where ?h=h and ?c=c and ?v=val and ?ret=h', OF assms(1)]
    store_cond_hard_cap(2)[where ?h=h and ?c=c and ?v=val and ?ret=h', OF assms(1)]
    store_cond_hard_cap(3)[where ?h=h and ?c=c and ?v=val and ?ret=h' and ?cv=x, OF assms(1)]
    store_cond_hard_cap(4)[where ?h=h and ?c=c and ?v=val and ?ret=h', OF assms(1)]
    store_cond_hard_cap(5)[where ?h=h and ?c=c and ?v=val and ?ret=h', OF assms(1)]
    store_cond_hard_cap(6)[where ?h=h and ?c=c and ?v=val and ?ret=h', OF assms(1)]
    assms
[PROOF STATE]
proof (prove)
using this:
tag c = True
perm_store c = True
\<lbrakk>val = Cap_v x; tag x\<rbrakk> \<Longrightarrow> perm_cap_store c \<and> (perm_cap_store_local c \<or> perm_global x)
offset c + int |memval_type val|\<^sub>\<tau> \<le> int (base c + len c)
int (base c) \<le> offset c
offset c mod int |memval_type val|\<^sub>\<tau> = 0
store h c val = Success h'
val = Cap_v x

goal (1 subgoal):
 1. \<not> (\<not> perm_cap_store c \<and> tag x) \<and> \<not> (\<not> perm_cap_store_local c \<and> tag x \<and> \<not> perm_global x)
[PROOF STEP]
unfolding store_def
[PROOF STATE]
proof (prove)
using this:
tag c = True
perm_store c = True
\<lbrakk>val = Cap_v x; tag x\<rbrakk> \<Longrightarrow> perm_cap_store c \<and> (perm_cap_store_local c \<or> perm_global x)
offset c + int |memval_type val|\<^sub>\<tau> \<le> int (base c + len c)
int (base c) \<le> offset c
offset c mod int |memval_type val|\<^sub>\<tau> = 0
(if tag c = False then Error (C2Err TagViolation) else if perm_store c = False then Error (C2Err PermitStoreViolation) else if case val of Cap_v cv \<Rightarrow> \<not> perm_cap_store c \<and> tag cv | _ \<Rightarrow> False then Error (C2Err PermitStoreCapViolation) else if case val of Cap_v cv \<Rightarrow> \<not> perm_cap_store_local c \<and> tag cv \<and> \<not> perm_global cv | _ \<Rightarrow> False then Error (C2Err PermitStoreLocalCapViolation) else if int (base c + len c) < offset c + int |memval_type val|\<^sub>\<tau> then Error (C2Err LengthViolation) else if offset c < int (base c) then Error (C2Err LengthViolation) else if offset c mod int |memval_type val|\<^sub>\<tau> \<noteq> 0 then Error (C2Err BadAddressViolation) else if val = Undef then Error (LogicErr (Unhandled STR '''')) else let obj = Mapping.lookup (heap_map h) (block_id c) in case obj of None \<Rightarrow> Error (LogicErr MissingResource) | Some Freed \<Rightarrow> Error (LogicErr UseAfterFree) | Some (Map m) \<Rightarrow> if offset c < int (fst (bounds m)) \<or> int (snd (bounds m)) < offset c + int |memval_type val|\<^sub>\<tau> then Error (LogicErr BufferOverrun) else Success (h\<lparr>heap_map := Mapping.update (block_id c) (Map (store_tval m (nat (offset c)) val)) (heap_map h)\<rparr>)) = Success h'
val = Cap_v x

goal (1 subgoal):
 1. \<not> (\<not> perm_cap_store c \<and> tag x) \<and> \<not> (\<not> perm_cap_store_local c \<and> tag x \<and> \<not> perm_global x)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> (\<not> perm_cap_store c \<and> tag x) \<and> \<not> (\<not> perm_cap_store_local c \<and> tag x \<and> \<not> perm_global x)

goal (1 subgoal):
 1. \<exists>m. Mapping.lookup (heap_map h) (block_id c) = Some (Map m) \<and> int (fst (bounds m)) \<le> offset c \<and> offset c + int |memval_type val|\<^sub>\<tau> \<le> int (snd (bounds m))
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> (\<not> perm_cap_store c \<and> tag x) \<and> \<not> (\<not> perm_cap_store_local c \<and> tag x \<and> \<not> perm_global x)

goal (1 subgoal):
 1. \<exists>m. Mapping.lookup (heap_map h) (block_id c) = Some (Map m) \<and> int (fst (bounds m)) \<le> offset c \<and> offset c + int |memval_type val|\<^sub>\<tau> \<le> int (snd (bounds m))
[PROOF STEP]
using store_cond_hard_cap(1)[where ?h=h and ?c=c and ?v=val and ?ret=h', OF assms(1)]
    store_cond_hard_cap(2)[where ?h=h and ?c=c and ?v=val and ?ret=h', OF assms(1)]
    store_cond_hard_cap(3)[where ?h=h and ?c=c and ?v=val and ?ret=h' and ?cv=x, OF assms(1)]
    store_cond_hard_cap(4)[where ?h=h and ?c=c and ?v=val and ?ret=h', OF assms(1)]
    store_cond_hard_cap(5)[where ?h=h and ?c=c and ?v=val and ?ret=h', OF assms(1)]
    store_cond_hard_cap(6)[where ?h=h and ?c=c and ?v=val and ?ret=h', OF assms(1)]
    assms
[PROOF STATE]
proof (prove)
using this:
\<not> (\<not> perm_cap_store c \<and> tag x) \<and> \<not> (\<not> perm_cap_store_local c \<and> tag x \<and> \<not> perm_global x)
tag c = True
perm_store c = True
\<lbrakk>val = Cap_v x; tag x\<rbrakk> \<Longrightarrow> perm_cap_store c \<and> (perm_cap_store_local c \<or> perm_global x)
offset c + int |memval_type val|\<^sub>\<tau> \<le> int (base c + len c)
int (base c) \<le> offset c
offset c mod int |memval_type val|\<^sub>\<tau> = 0
store h c val = Success h'
val = Cap_v x

goal (1 subgoal):
 1. \<exists>m. Mapping.lookup (heap_map h) (block_id c) = Some (Map m) \<and> int (fst (bounds m)) \<le> offset c \<and> offset c + int |memval_type val|\<^sub>\<tau> \<le> int (snd (bounds m))
[PROOF STEP]
by (simp split: ccval.split option.split_asm t.split_asm add: store_def cap_perms)
      (metis linorder_not_le result.distinct(1))
[PROOF STATE]
proof (state)
this:
\<exists>m. Mapping.lookup (heap_map h) (block_id c) = Some (Map m) \<and> int (fst (bounds m)) \<le> offset c \<and> offset c + int |memval_type val|\<^sub>\<tau> \<le> int (snd (bounds m))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_shadow_root_opt_type_wf_preserved [simp]:
  assumes "h \<turnstile> put_M element_ptr shadow_root_opt_update v \<rightarrow>\<^sub>h h'"
  shows "type_wf h = type_wf h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ShadowRootClass.type_wf h = ShadowRootClass.type_wf h'
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ShadowRootClass.type_wf h = ShadowRootClass.type_wf h'
[PROOF STEP]
have "object_ptr_kinds h = object_ptr_kinds h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. object_ptr_kinds h = object_ptr_kinds h'
[PROOF STEP]
using writes_singleton assms object_ptr_kinds_preserved
[PROOF STATE]
proof (prove)
using this:
writes (all_args ?f) (?f ?a) ?h ?h'
h \<turnstile> put_M element_ptr shadow_root_opt_update v \<rightarrow>\<^sub>h h'
\<lbrakk>writes ?SW ?setter ?h ?h'; ?h \<turnstile> ?setter \<rightarrow>\<^sub>h ?h'; \<And>h h' w object_ptr. \<lbrakk>w \<in> ?SW; h \<turnstile> w \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> preserved (get_M object_ptr RObject.nothing) h h'\<rbrakk> \<Longrightarrow> object_ptr_kinds ?h = object_ptr_kinds ?h'

goal (1 subgoal):
 1. object_ptr_kinds h = object_ptr_kinds h'
[PROOF STEP]
unfolding all_args_def
[PROOF STATE]
proof (prove)
using this:
writes (\<Union>arg. {?f arg}) (?f ?a) ?h ?h'
h \<turnstile> put_M element_ptr shadow_root_opt_update v \<rightarrow>\<^sub>h h'
\<lbrakk>writes ?SW ?setter ?h ?h'; ?h \<turnstile> ?setter \<rightarrow>\<^sub>h ?h'; \<And>h h' w object_ptr. \<lbrakk>w \<in> ?SW; h \<turnstile> w \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> preserved (get_M object_ptr RObject.nothing) h h'\<rbrakk> \<Longrightarrow> object_ptr_kinds ?h = object_ptr_kinds ?h'

goal (1 subgoal):
 1. object_ptr_kinds h = object_ptr_kinds h'
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
object_ptr_kinds h = object_ptr_kinds h'

goal (1 subgoal):
 1. ShadowRootClass.type_wf h = ShadowRootClass.type_wf h'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
object_ptr_kinds h = object_ptr_kinds h'
[PROOF STEP]
have "shadow_root_ptr_kinds h = shadow_root_ptr_kinds h'"
[PROOF STATE]
proof (prove)
using this:
object_ptr_kinds h = object_ptr_kinds h'

goal (1 subgoal):
 1. shadow_root_ptr_kinds h = shadow_root_ptr_kinds h'
[PROOF STEP]
by(auto simp add: shadow_root_ptr_kinds_def document_ptr_kinds_def)
[PROOF STATE]
proof (state)
this:
shadow_root_ptr_kinds h = shadow_root_ptr_kinds h'

goal (1 subgoal):
 1. ShadowRootClass.type_wf h = ShadowRootClass.type_wf h'
[PROOF STEP]
with assms
[PROOF STATE]
proof (chain)
picking this:
h \<turnstile> put_M element_ptr shadow_root_opt_update v \<rightarrow>\<^sub>h h'
shadow_root_ptr_kinds h = shadow_root_ptr_kinds h'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
h \<turnstile> put_M element_ptr shadow_root_opt_update v \<rightarrow>\<^sub>h h'
shadow_root_ptr_kinds h = shadow_root_ptr_kinds h'

goal (1 subgoal):
 1. ShadowRootClass.type_wf h = ShadowRootClass.type_wf h'
[PROOF STEP]
by(auto simp add: ElementMonad.put_M_defs type_wf_defs)
[PROOF STATE]
proof (state)
this:
ShadowRootClass.type_wf h = ShadowRootClass.type_wf h'

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma  "clop (f::'a::complete_lattice \<Rightarrow> 'a) \<Longrightarrow> f \<bottom> = \<bottom>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. clop f \<Longrightarrow> bot_pres f
[PROOF STEP]
(*nitpick *)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. clop f \<Longrightarrow> bot_pres f
[PROOF STEP]
oops


[STATEMENT]
lemma [iff]:
  "\<forall>y_ty_list vds vars vs. length y_ty_list = length vars' \<and> length vds = length vars' \<and> length vars = length vars' \<and> length vs = length vars' \<longrightarrow>
   map (\<lambda>(y, cl, var, var', v). (x_var var, x_var var'))
       (zip (map fst y_ty_list) (zip (map (case_vd (\<lambda>cl var. cl)) vds) (zip (map (case_vd (\<lambda>cl var. var)) vds) (zip vars' vs)))) =
     zip (map (case_vd (\<lambda>cl. x_var)) vds) (map x_var vars')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>y_ty_list vds vars vs. length y_ty_list = length vars' \<and> length vds = length vars' \<and> length vars = length vars' \<and> length vs = length vars' \<longrightarrow> map2 (\<lambda>y (cl, var, var', v). (x_var var, x_var var')) (map fst y_ty_list) (zip (map (case_vd (\<lambda>cl var. cl)) vds) (zip (map (case_vd (\<lambda>cl var. var)) vds) (zip vars' vs))) = zip (map (case_vd (\<lambda>cl. x_var)) vds) (map x_var vars')
[PROOF STEP]
apply(induct vars')
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<forall>y_ty_list vds vars vs. length y_ty_list = length [] \<and> length vds = length [] \<and> length vars = length [] \<and> length vs = length [] \<longrightarrow> map2 (\<lambda>y a. case a of (cl, var, var', v) \<Rightarrow> (x_var var, x_var var')) (map fst y_ty_list) (zip (map (\<lambda>a. case a of vd_def cl var \<Rightarrow> cl) vds) (zip (map (\<lambda>a. case a of vd_def cl var \<Rightarrow> var) vds) (zip [] vs))) = zip (map (\<lambda>a. case a of vd_def cl a \<Rightarrow> x_var a) vds) (map x_var [])
 2. \<And>a vars'. \<forall>y_ty_list vds vars vs. length y_ty_list = length vars' \<and> length vds = length vars' \<and> length vars = length vars' \<and> length vs = length vars' \<longrightarrow> map2 (\<lambda>y a. case a of (cl, var, var', v) \<Rightarrow> (x_var var, x_var var')) (map fst y_ty_list) (zip (map (\<lambda>a. case a of vd_def cl var \<Rightarrow> cl) vds) (zip (map (\<lambda>a. case a of vd_def cl var \<Rightarrow> var) vds) (zip vars' vs))) = zip (map (\<lambda>a. case a of vd_def cl a \<Rightarrow> x_var a) vds) (map x_var vars') \<Longrightarrow> \<forall>y_ty_list vds vars vs. length y_ty_list = length (a # vars') \<and> length vds = length (a # vars') \<and> length vars = length (a # vars') \<and> length vs = length (a # vars') \<longrightarrow> map2 (\<lambda>y a. case a of (cl, var, var', v) \<Rightarrow> (x_var var, x_var var')) (map fst y_ty_list) (zip (map (\<lambda>a. case a of vd_def cl var \<Rightarrow> cl) vds) (zip (map (\<lambda>a. case a of vd_def cl var \<Rightarrow> var) vds) (zip (a # vars') vs))) = zip (map (\<lambda>a. case a of vd_def cl a \<Rightarrow> x_var a) vds) (map x_var (a # vars'))
[PROOF STEP]
apply(simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a vars'. \<forall>y_ty_list vds vars vs. length y_ty_list = length vars' \<and> length vds = length vars' \<and> length vars = length vars' \<and> length vs = length vars' \<longrightarrow> map2 (\<lambda>y a. case a of (cl, var, var', v) \<Rightarrow> (x_var var, x_var var')) (map fst y_ty_list) (zip (map (\<lambda>a. case a of vd_def cl var \<Rightarrow> cl) vds) (zip (map (\<lambda>a. case a of vd_def cl var \<Rightarrow> var) vds) (zip vars' vs))) = zip (map (\<lambda>a. case a of vd_def cl a \<Rightarrow> x_var a) vds) (map x_var vars') \<Longrightarrow> \<forall>y_ty_list vds vars vs. length y_ty_list = length (a # vars') \<and> length vds = length (a # vars') \<and> length vars = length (a # vars') \<and> length vs = length (a # vars') \<longrightarrow> map2 (\<lambda>y a. case a of (cl, var, var', v) \<Rightarrow> (x_var var, x_var var')) (map fst y_ty_list) (zip (map (\<lambda>a. case a of vd_def cl var \<Rightarrow> cl) vds) (zip (map (\<lambda>a. case a of vd_def cl var \<Rightarrow> var) vds) (zip (a # vars') vs))) = zip (map (\<lambda>a. case a of vd_def cl a \<Rightarrow> x_var a) vds) (map x_var (a # vars'))
[PROOF STEP]
apply(clarsimp simp add: set_zip length_Suc_conv split: vd.splits)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma DynCastRedsThrow:
  "\<lbrakk> P,E \<turnstile> \<langle>e,s\<rangle> \<rightarrow>* \<langle>Throw r,s'\<rangle> \<rbrakk> \<Longrightarrow> P,E \<turnstile> \<langle>Cast C e,s\<rangle> \<rightarrow>* \<langle>Throw r,s'\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P,E \<turnstile> \<langle>e,s\<rangle> \<rightarrow>* \<langle>Throw r,s'\<rangle> \<Longrightarrow> P,E \<turnstile> \<langle>Cast C e,s\<rangle> \<rightarrow>* \<langle>Throw r,s'\<rangle>
[PROOF STEP]
apply(rule rtrancl_into_rtrancl)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. P,E \<turnstile> \<langle>e,s\<rangle> \<rightarrow>* \<langle>Throw r,s'\<rangle> \<Longrightarrow> ((Cast C e, s), ?b) \<in> (Red P E)\<^sup>*
 2. P,E \<turnstile> \<langle>e,s\<rangle> \<rightarrow>* \<langle>Throw r,s'\<rangle> \<Longrightarrow> (?b, Throw r, s') \<in> Red P E
[PROOF STEP]
apply(erule DynCastReds)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P,E \<turnstile> \<langle>e,s\<rangle> \<rightarrow>* \<langle>Throw r,s'\<rangle> \<Longrightarrow> ((Cast C (Throw r), s'), Throw r, s') \<in> Red P E
[PROOF STEP]
apply(simp add:red_reds.DynCastThrow)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma weakenStatImpMonotonic:
  fixes \<Psi> :: 'b
  and   P :: "('a, 'b, 'c) psi"
  and   A :: "('b \<times> ('a, 'b, 'c) psi \<times> ('a, 'b, 'c) psi) set"
  and   Q :: "('a, 'b, 'c) psi"
  and   B :: "('b \<times> ('a, 'b, 'c) psi \<times> ('a, 'b, 'c) psi) set"

  assumes "\<Psi> \<rhd> P \<lessapprox>\<^sub>w<A> Q"
  and     "A \<subseteq> B"

  shows "\<Psi> \<rhd> P \<lessapprox>\<^sub>w<B> Q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Psi> \<rhd> P \<lessapprox>\<^sub>w<B> Q
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
\<Psi> \<rhd> P \<lessapprox>\<^sub>w<A> Q
A \<subseteq> B

goal (1 subgoal):
 1. \<Psi> \<rhd> P \<lessapprox>\<^sub>w<B> Q
[PROOF STEP]
by(auto simp add: weakenStatImp_def)