From 97cfa202a0f26dd8060ea4636f232bfe9c8aad5a Mon Sep 17 00:00:00 2001 From: cassiatorczon Date: Thu, 1 May 2025 02:05:21 -0400 Subject: [PATCH 1/8] string lib --- src/exercises/string/array.h | 0 src/exercises/string/cn_types.h | 48 ++ .../state__util.c__len_lt_buf_size.html | 698 ++++++++++++++++++ src/exercises/string/example.c | 49 ++ src/exercises/string/lemmas.h | 57 ++ src/exercises/string/spec_funs.h | 53 ++ src/exercises/string/string.c | 89 +++ src/exercises/string/string_buf.c | 74 ++ src/exercises/string/util.c | 43 ++ 9 files changed, 1111 insertions(+) create mode 100644 src/exercises/string/array.h create mode 100644 src/exercises/string/cn_types.h create mode 100644 src/exercises/string/error_files/state__util.c__len_lt_buf_size.html create mode 100644 src/exercises/string/example.c create mode 100644 src/exercises/string/lemmas.h create mode 100644 src/exercises/string/spec_funs.h create mode 100644 src/exercises/string/string.c create mode 100644 src/exercises/string/string_buf.c create mode 100644 src/exercises/string/util.c diff --git a/src/exercises/string/array.h b/src/exercises/string/array.h new file mode 100644 index 00000000..e69de29b diff --git a/src/exercises/string/cn_types.h b/src/exercises/string/cn_types.h new file mode 100644 index 00000000..fe1c6786 --- /dev/null +++ b/src/exercises/string/cn_types.h @@ -0,0 +1,48 @@ +/*@ + +datatype String { + String_Nil {}, + String_Cons { u8 head, datatype String tail} +} + +@*/ + +/*@ +// null-terminated strings with (potentially) extra buffer space + +datatype String_Buf { + String_Buf { + datatype String chars, + size_t buf_len // full buffer length, including chars + } +} + +predicate (datatype String_Buf) String_Buf_At(pointer p, size_t buf_len) { + take s = String(p, buf_len); + return String_Buf { chars : s, buf_len : buf_len}; +} + +predicate (datatype String) String(pointer p, size_t buf_len) { + assert (buf_len >= 1u64); + take h = RW(p); + take s = String_Aux(p, buf_len, h); + return s; +} + +// p: pointer to h +// buf_len: length of buffer including h +// h: first character of string starting at p +predicate (datatype String) String_Aux(pointer p, size_t buf_len, u8 h) { + if (h == 0u8) { + // TODO: initially I did not have "0u64 < i" but did not get any error + // indicating I was taking the same thing twice + take rem = each (size_t i; 0u64 < i && i < buf_len - 1u64) { + W( array_shift(p, i)) }; + return String_Nil {}; + } else { + take tl_buf = String_Buf_At(array_shift(p, 1u64), buf_len - 1u64); + return String_Cons {head : h, tail : tl}; + } +} + +@*/ diff --git a/src/exercises/string/error_files/state__util.c__len_lt_buf_size.html b/src/exercises/string/error_files/state__util.c__len_lt_buf_size.html new file mode 100644 index 00000000..2f383640 --- /dev/null +++ b/src/exercises/string/error_files/state__util.c__len_lt_buf_size.html @@ -0,0 +1,698 @@ + + + + + +CN state explorer + + + +
+
+ +

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

(none)

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
&c1{@7; 0x4000005800}

Constraints

(none)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

(same type) String_Buf_At(s, n)(sIn)

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&c1{@7; 0x4000005800}

Constraints

(none)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ + , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ + , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ + , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ + , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])
+
+
+ +
#include "string_buf.c" + +// UTILITIES + +void nonempty_buf_size(char *s, size_t n) +/*@ +requires + take sIn = String_Buf_At(s, n); + chars(sIn) != String_Nil{}; +ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + n > 1u64; +@*/ +{ + char c = s[0]; + /*@ split_case (c == 0u8); @*/ +} + +void len_lt_buf_size(char *s, size_t n) +/*@ +requires + take sIn = String_Buf_At(s, n); +ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + string_buf_len(sOut) < n; +@*/ +{ + char c = s[0]; + + if (c == '\0') + { + /*@ unfold string_buf_len(String_Buf {buf_len: n, chars: String_Nil {}}); @*/ + /*@ unfold string_len(String_Nil{});@*/ + } + else + { + char c1 = s[1]; + nonempty_buf_size(s, n); + len_lt_buf_size(&c1, n - (unsigned long long)1); + } +}
+
+
+ + + diff --git a/src/exercises/string/example.c b/src/exercises/string/example.c new file mode 100644 index 00000000..a0770209 --- /dev/null +++ b/src/exercises/string/example.c @@ -0,0 +1,49 @@ +#include "util.c" + +void simple_ex(char *s, unsigned long long n) +/*@ + requires + take sIn = String_Buf_At(s, n); + n < 3u64; + ensures + true; +@*/ +{ + char *sb = malloc_str(5); + unsigned long long m = str_buf_len(sb, 5); + // m == 0 + + /*@ apply len_lt_buf_size(s, n); @*/ + sb = str_buf_cpy(sb, s, 5, n); + + m = str_buf_len(sb, 5); + // m == n + + int j = str_buf_cmp(s, sb, n, 5); + // j == 0 + + /*@ apply string_buf_to_array(s, n); @*/ + /*@ focus RW, 0u64; @*/ + write(s, n, 0, 'c'); + /*@ apply array_to_string_buf(s, n); @*/ + /*@ apply string_buf_to_array(sb, 5u64); @*/ + /*@ focus RW, 0u64; @*/ + write(sb, 5, 0, 'g'); + /*@ apply array_to_string_buf(sb, 5u64); @*/ + + j = str_buf_cmp(s, sb, n, 5); + // j != 0 + + /*@ + unfold string_buf_len(sIn); + assert (string_buf_len(sIn) <= 1u64); + @*/ + sb = str_buf_cat(sb, s, 5, n); + m = str_buf_len(sb, 5); + // m == 2 * n + + free_str(sb, 5); + free_str(s, n); +} + +// parser and printer of pairs of numbers \ No newline at end of file diff --git a/src/exercises/string/lemmas.h b/src/exercises/string/lemmas.h new file mode 100644 index 00000000..43c966b7 --- /dev/null +++ b/src/exercises/string/lemmas.h @@ -0,0 +1,57 @@ +#include "util.c" + +/*@ +// conversion to and from arrays + +lemma array_to_string_buf(pointer s, size_t n) + requires + take sArray = each(u64 i; i < n) { + RW( array_shift(s, i)) }; + ensures + take sBuf = String_Buf_At(s, n); + each (u64 i; i < string_buf_len(sBuf)) { + string_buf_nth(sBuf, i) == sArray[i] + }; + +lemma string_buf_to_array(pointer s, size_t n) + requires + take sBuf = String_Buf_At(s, n); + ensures + take sArray = each(u64 i; i < n) { + RW( array_shift(s, i)) }; + each (u64 i; i < string_buf_len(sBuf)) { + string_buf_nth(sBuf, i) == sArray[i] + }; + +@*/ + +/*@ +// length lemmas + +lemma len_lt_buf_size (pointer s, size_t n) + requires + take sIn = String_Buf_At(s, n); + ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + match sOut { + String_Buf { chars : cs, buf_len : n0 } => { + (string_buf_len(sOut) < n0) && (n == n0) + } + }; + +lemma lt_len_impl_nonzero (pointer s, size_t n) + requires + take sBuf = String_Buf_At(s, n); + ensures + take sArray = each(u64 i; i < n) { + RW( array_shift(s, i)) }; + each (u64 i; i < string_buf_len(sBuf)) { + string_buf_nth(sBuf, i) == sArray[i] + }; + each (u64 i; i < string_buf_len(sBuf)) { + sArray[i] != 0u8 + }; + + +@*/ diff --git a/src/exercises/string/spec_funs.h b/src/exercises/string/spec_funs.h new file mode 100644 index 00000000..771ed871 --- /dev/null +++ b/src/exercises/string/spec_funs.h @@ -0,0 +1,53 @@ +#include "cn_types.h" + +/*@ +function (datatype String) chars(String_Buf s) { + match s { + String_Buf { chars : cs, buf_len : n } => { cs } + } +} + +function (u64) buf_len(String_Buf s) { + match s { + String_Buf { chars : cs, buf_len : n } => { n } + } +} + +function [rec] (u64) string_len(String s) { + match s { + String_Nil {} => { 0u64 } + String_Cons { head : h , tail : tl } => { 1u64 + string_len(tl) } + } +} + +function [rec] (u64) string_buf_len(String_Buf sb) { + match sb { + String_Buf { chars : cs, buf_len : n } => { string_len(cs) } + } +} + +function [rec] (datatype String) string_concat(String s1, String s2) { + match s1 { + String_Nil {} => { s2 } + String_Cons { head : h , tail : tl } => { + String_Cons { head : h, tail : string_concat(tl, s2) } + } + } +} + +// defaults to \0 +function [rec] (u8) string_nth(String s, u64 n) { + match s { + String_Nil {} => { 0u8 } + String_Cons { head : h , tail : tl } => { + n == 0u64 ? h : string_nth(tl, n - 1u64) + } + } +} + +function [rec] (u8) string_buf_nth(String_Buf sb, u64 n) { + match sb { + String_Buf { chars : cs, buf_len : n0 } => { string_nth(cs, n) } + } +} +@*/ \ No newline at end of file diff --git a/src/exercises/string/string.c b/src/exercises/string/string.c new file mode 100644 index 00000000..53e647d8 --- /dev/null +++ b/src/exercises/string/string.c @@ -0,0 +1,89 @@ +#include +#include "spec_funs.h" + +/*@ +// null-terminated strings with no extra buffer + +predicate (datatype String) String_At(pointer p) { + take h = RW(p); + take s = String_At_Aux(p, h); + return s; +} + +predicate (datatype String) String_At_Aux(pointer p, u8 h) { + if (h == 0u8) { + return String_Nil {}; + } else { + take tl = String_At(array_shift(p, 1u64)); + return String_Cons {head : h, tail : tl}; + } +} + +// function [rec] (u64) string_len(String s) { +// match s { +// String_Nil {} => { 0u64 } +// String_Cons { head : h , tail : tl } => { 1u64 + string_len(tl) } +// } +// } + +// function [rec] (datatype String) string_concat(String s1, String s2) { +// match s1 { +// String_Nil {} => { s2 } +// String_Cons { head : h , tail : tl } => { +// String_Cons { head : h, tail : string_concat(tl, s2) } +// } +// } +// } +@*/ + +// library functions with minimal buffer size arguments + +extern size_t strlen(const char *s); +/*@ spec strlen(pointer s); + requires + take sIn = String_At(s); + ensures + take sOut = String_At(s); + sIn == sOut; + return == string_len(sIn); +@*/ + +extern char *strlcpy(char *dest, const char *src, size_t dest_size); +/*@ spec strlcpy(pointer dest, pointer src, u64 dest_size); + requires + take srcIn = String_At(src); + take destIn = String_Buf_At(dest, dest_size); + string_len(srcIn) < dest_size; // < to leave room for the null + ensures + take srcOut = String_At(src); + take destOut = String_Buf_At(dest, dest_size); + srcIn == srcOut; + destOut == String_Buf { chars : srcIn, buf_len : dest_size }; + ptr_eq(return, dest); +@*/ + +extern int strcmp(char *s1, char *s2); +/*@ spec strcmp(pointer s1, pointer s2); + requires + take s1In = String_At(s1); + take s2In = String_At(s2); + ensures + take s1Out = String_At(s1); + take s2Out = String_At(s2); + s1In == s1Out; + s2In == s2Out; + (return == 0i32) ? s1In == s2In : s1In != s2In; +@*/ + +extern char *strcat(char *dest, const char *src, size_t dest_size); +/*@ spec strcat(pointer dest, pointer src, u64 dest_size); + requires + take srcIn = String_At(src); + take destIn = String_Buf_At(dest, dest_size); + string_len(srcIn) + string_buf_len(destIn) < dest_size; // < to leave room for the null + ensures + take srcOut = String_At(src); + take destOut = String_Buf_At(dest, dest_size); + srcIn == srcOut; + destOut == String_Buf { chars : string_concat(srcIn, chars(destIn)), buf_len : buf_len(destIn) }; +@*/ \ No newline at end of file diff --git a/src/exercises/string/string_buf.c b/src/exercises/string/string_buf.c new file mode 100644 index 00000000..38a5092b --- /dev/null +++ b/src/exercises/string/string_buf.c @@ -0,0 +1,74 @@ +#include +#include "spec_funs.h" + +// /* NULL-TERMINATED STRING STANDARD LIBRARY FUNCTIONS */ + +extern char *malloc_str(size_t n); +/*@ spec malloc_str(size_t n); + requires + 1u64 <= n; // 1 byte is required for null termination + ensures + take s = String_Buf_At(return, n); +@*/ + +extern void free_str(char *p, size_t n); +/*@ spec free_str(pointer p, u64 n); + requires + take s = String_Buf_At(p, n); + ensures + true; +@*/ + +// buffer version of strlen +extern size_t str_buf_len(const char *s, size_t n); +/*@ spec str_buf_len(pointer s, u64 n); + requires + take sIn = String_Buf_At(s, n); + ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + return == string_buf_len(sIn); +@*/ + +// buffer version of strcpy +extern char *str_buf_cpy(char *dest, const char *src, size_t dest_size, size_t src_size); +/*@ spec str_buf_cpy(pointer dest, pointer src, u64 dest_size, u64 src_size); + requires + take srcIn = String_Buf_At(src, src_size); + take destIn = String_Buf_At(dest, dest_size); + string_buf_len(srcIn) < dest_size; // < to leave room for the null + ensures + take srcOut = String_Buf_At(src, src_size); + take destOut = String_Buf_At(dest, dest_size); + srcIn == srcOut; + destOut == String_Buf { chars : chars(srcIn), buf_len : dest_size }; + ptr_eq(return, dest); +@*/ + +// buffer version of strcmp; does not compare buffer size +extern int str_buf_cmp(char *s1, char *s2, size_t n1, size_t n2); +/*@ spec str_buf_cmp(pointer s1, pointer s2, u64 n1, u64 n2); + requires + take s1In = String_Buf_At(s1, n1); + take s2In = String_Buf_At(s2, n2); + ensures + take s1Out = String_Buf_At(s1, n1); + take s2Out = String_Buf_At(s2, n2); + s1In == s1Out; + s2In == s2Out; + (return == 0i32) ? s1In == s2In : s1In != s2In; +@*/ + +// buffer version of strcat +extern char *str_buf_cat(char *dest, const char *src, size_t dest_size, size_t src_size); +/*@ spec str_buf_cat(pointer dest, pointer src, u64 dest_size, u64 src_size); + requires + take srcIn = String_Buf_At(src, src_size); + take destIn = String_Buf_At(dest, dest_size); + string_buf_len(srcIn) + string_buf_len(destIn) < dest_size; // < to leave room for the null + ensures + take srcOut = String_Buf_At(src, src_size); + take destOut = String_Buf_At(dest, dest_size); + srcIn == srcOut; + destOut == String_Buf { chars : string_concat( chars(srcIn), chars(destIn)), buf_len : dest_size}; +@*/ \ No newline at end of file diff --git a/src/exercises/string/util.c b/src/exercises/string/util.c new file mode 100644 index 00000000..b4fea416 --- /dev/null +++ b/src/exercises/string/util.c @@ -0,0 +1,43 @@ +#include "string_buf.c" + +// UTILITIES + +void nonempty_buf_size(char *s, size_t n) +/*@ +requires + take sIn = String_Buf_At(s, n); + chars(sIn) != String_Nil{}; +ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + n > 1u64; +@*/ +{ + char c = s[0]; + /*@ split_case (c == 0u8); @*/ +} + +void len_lt_buf_size(char *s, size_t n) +/*@ +requires + take sIn = String_Buf_At(s, n); +ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + string_buf_len(sOut) < n; +@*/ +{ + char c = s[0]; + + if (c == '\0') + { + /*@ unfold string_buf_len(String_Buf {buf_len: n, chars: String_Nil {}}); @*/ + /*@ unfold string_len(String_Nil{});@*/ + } + else + { + char c1 = s[1]; + nonempty_buf_size(s, n); + len_lt_buf_size(&c1, n - (unsigned long long)1); + } +} \ No newline at end of file From 48ec1b323f3b0288c64c85581b85bc0eb8785bf4 Mon Sep 17 00:00:00 2001 From: cassiatorczon Date: Thu, 1 May 2025 02:26:36 -0400 Subject: [PATCH 2/8] mixed recursive style --- src/exercises/string/cn_types.h | 11 +- .../state__util.c__len_lt_buf_size.html | 698 ------------------ 2 files changed, 2 insertions(+), 707 deletions(-) delete mode 100644 src/exercises/string/error_files/state__util.c__len_lt_buf_size.html diff --git a/src/exercises/string/cn_types.h b/src/exercises/string/cn_types.h index fe1c6786..3c8305be 100644 --- a/src/exercises/string/cn_types.h +++ b/src/exercises/string/cn_types.h @@ -18,15 +18,10 @@ datatype String_Buf { } predicate (datatype String_Buf) String_Buf_At(pointer p, size_t buf_len) { - take s = String(p, buf_len); - return String_Buf { chars : s, buf_len : buf_len}; -} - -predicate (datatype String) String(pointer p, size_t buf_len) { assert (buf_len >= 1u64); take h = RW(p); take s = String_Aux(p, buf_len, h); - return s; + return String_Buf { chars : s, buf_len : buf_len}; } // p: pointer to h @@ -34,14 +29,12 @@ predicate (datatype String) String(pointer p, size_t buf_len) { // h: first character of string starting at p predicate (datatype String) String_Aux(pointer p, size_t buf_len, u8 h) { if (h == 0u8) { - // TODO: initially I did not have "0u64 < i" but did not get any error - // indicating I was taking the same thing twice take rem = each (size_t i; 0u64 < i && i < buf_len - 1u64) { W( array_shift(p, i)) }; return String_Nil {}; } else { take tl_buf = String_Buf_At(array_shift(p, 1u64), buf_len - 1u64); - return String_Cons {head : h, tail : tl}; + return String_Cons {head : h, tail : chars(tl_buf)}; } } diff --git a/src/exercises/string/error_files/state__util.c__len_lt_buf_size.html b/src/exercises/string/error_files/state__util.c__len_lt_buf_size.html deleted file mode 100644 index 2f383640..00000000 --- a/src/exercises/string/error_files/state__util.c__len_lt_buf_size.html +++ /dev/null @@ -1,698 +0,0 @@ - - - - - -CN state explorer - - - -
-
- -

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

(none)

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
&c1{@7; 0x4000005800}

Constraints

(none)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

(same type) String_Buf_At(s, n)(sIn)

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&c1{@7; 0x4000005800}

Constraints

(none)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c)(default(u8))
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
String_Aux(s, n, unpack_String28.h)(unpack_String28.s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
1'u64 <= n
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

W<char>(&c1)(default(u8))
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

RW<char>(&c1)(unpack_String29.h)
String_Aux(&s[1'u64], n - 1'u64, unpack_String29.h)(unpack_String29.s)
RW<char>(&s[1'u64])(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
RW<char>(s)(unpack_String28.h)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c1)(unpack_String29.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])

Requested resource

String_Buf_At(&c1, n - 1'u64)

Possibly relevant predicate clauses

conditionclause
truetake s = String(p, buf_len); String_Buf {buf_len: buf_len, chars: s}

Definitions and constraints not handled automatically

Alloc
String_Aux
string_len
string_buf_len
string_concat
string_nth
string_buf_nth

Available resources

String_Aux(s, n, unpack_String30.h)(unpack_String30.s)
RW<char>(s)(unpack_String30.h)
RW<char>(&c)(unpack_String28.h)
RW<size_t>(&ARG1)(n)
RW<char*>(&ARG0)(s)
more
Alloc(&c1)(allocs[(alloc_id)&c1])
Alloc(&c)(allocs[(alloc_id)&c])
Alloc(&ARG1)(allocs[(alloc_id)&ARG1])
Alloc(&ARG0)(allocs[(alloc_id)&ARG0])

Terms

termvalue
allocsconst({ .base = 5082628840178581504'u64 /* 0x4689200050000000 */, .size = 8'u64 })[@5 = { .base = 7927461296021198848'u64 /* 0x6e04000c18005800 */ - , .size = 8'u64 }][@6 = { .base = 9223372036854775808'u64 /* 0x8000000000000000 */ - , .size = 1'u64 }][@3 = { .base = 171915244577875968'u64 /* 0x262c4010c89e800 */ - , .size = 13857017777464082432'u64 /* 0xc04e044040050000 */ }][@7 = { .base = 274877929472'u64 /* 0x4000005800 */ - , .size = 1'u64 }]
n9223372036854775808'u64 /* 0x8000000000000000 */
sInString_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}}
unpack_String_Buf_At25{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String28{ .h = 4'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String_Aux3{ .tl = String_Nil {} }
unpack_String29{ .h = 0'u8, .s = String_Nil {} }
call_nonempty_buf_size0{ .return = void, .sOut = String_Buf {buf_len: 9223372036854775808'u64 /* 0x8000000000000000 */, chars: String_Cons {head: 4'u8, tail: String_Nil {}}} }
unpack_String_Buf_At26{ .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
unpack_String30{ .h = 0'u8, .s = String_Cons {head: 4'u8, tail: String_Nil {}} }
n - 1'u649223372036854775807'u64 /* 0x7fffffffffffffff */
more
termvalue
__builtin_ctzlNULL
__builtin_ctzllNULL
malloc_strNULL
free_strNULL
str_buf_lenNULL
str_buf_cpyNULL
str_buf_cmpNULL
str_buf_catNULL
nonempty_buf_sizeNULL
len_lt_buf_sizeNULL
s{@3; 0x1d005800cc05ffff}
&ARG0{@4; 0x4689200050000000}
&ARG1{@5; 0x6e04000c18005800}
&c{@6; 0x8000000000000000}
&c1{@7; 0x4000005800}

Constraints

true
(i32)unpack_String28.h != 0'i32
(u64)s + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG0 || (u64)&ARG0 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c
(u64)s + 1'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&s[1'u64]
(u64)s + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)s
(u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&ARG1
(u64)&ARG0 + 8'u64 <= (u64)&ARG1 || (u64)&ARG1 + 8'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c
(u64)&ARG0 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG0
(u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG0
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)&ARG0 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG0
(u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c
(u64)&ARG1 + 8'u64 <= (u64)&c || (u64)&c + 1'u64 <= (u64)&ARG1
(u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&ARG1
(u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)&ARG1 + 8'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&ARG1
(u64)s + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&c
(u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c + 1'u64 <= (u64)&s[1'u64] || (u64)&s[1'u64] + 1'u64 <= (u64)&c
(u64)&c1 + 1'u64 <= (u64)s
(u64)&c1 + 1'u64 <= (u64)s || (u64)s + 1'u64 <= (u64)&c1
(u64)&c1 + 1'u64 <= (u64)&s[1'u64]
(u64)&s[1'u64] + 1'u64 <= (u64)&c1 || (u64)&c1 + 1'u64 <= (u64)&s[1'u64]
1'u64 < n
1'u64 <= n
1'u64 <= n - 1'u64
(u64)s + 1'u64 <= allocs[(alloc_id)s].base + allocs[(alloc_id)s].size
(u64)&ARG0 + 8'u64 <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
(u64)&ARG1 + 8'u64 <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
(u64)&c + 1'u64 <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
(u64)&c1 + 1'u64 <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
(u64)&s[1'u64] + 1'u64 <= allocs[(alloc_id)&s[1'u64]].base + allocs[(alloc_id)&s[1'u64]].size
allocs[(alloc_id)s].base <= (u64)s
allocs[(alloc_id)&ARG0].base <= allocs[(alloc_id)&ARG0].base + allocs[(alloc_id)&ARG0].size
allocs[(alloc_id)&ARG0].base <= (u64)&ARG0
allocs[(alloc_id)&ARG1].base <= allocs[(alloc_id)&ARG1].base + allocs[(alloc_id)&ARG1].size
allocs[(alloc_id)&ARG1].base <= (u64)&ARG1
allocs[(alloc_id)&c].base <= allocs[(alloc_id)&c].base + allocs[(alloc_id)&c].size
allocs[(alloc_id)&c].base <= (u64)&c
allocs[(alloc_id)&c1].base <= allocs[(alloc_id)&c1].base + allocs[(alloc_id)&c1].size
allocs[(alloc_id)&c1].base <= (u64)&c1
allocs[(alloc_id)&s[1'u64]].base <= (u64)&s[1'u64]
(u64)s <= (u64)s + 1'u64
(u64)&ARG0 <= (u64)&ARG0 + 8'u64
(u64)&ARG1 <= (u64)&ARG1 + 8'u64
(u64)&c <= (u64)&c + 1'u64
(u64)&c1 <= (u64)&c1 + 1'u64
(u64)&s[1'u64] <= (u64)&s[1'u64] + 1'u64
sIn == String_Buf {buf_len: n, chars: unpack_String_Buf_At25.s}
unpack_String_Buf_At25.s == unpack_String28.s
unpack_String28.s == String_Cons {head: unpack_String28.h, tail: unpack_String_Aux3.tl}
unpack_String_Aux3.tl == unpack_String29.s
call_nonempty_buf_size0.sOut == String_Buf {buf_len: n, chars: unpack_String_Buf_At26.s}
unpack_String_Buf_At26.s == unpack_String30.s
String_Buf {buf_len: n, chars: String_Cons {head: unpack_String28.h, tail: unpack_String29.s}} == call_nonempty_buf_size0.sOut
allocs[(alloc_id)&ARG0] == { .base = (u64)&ARG0, .size = 8'u64 }
allocs[(alloc_id)&ARG1] == { .base = (u64)&ARG1, .size = 8'u64 }
allocs[(alloc_id)&c] == { .base = (u64)&c, .size = 1'u64 }
allocs[(alloc_id)&c1] == { .base = (u64)&c1, .size = 1'u64 }
has_alloc_id(s)
has_alloc_id(&ARG0)
has_alloc_id(&ARG1)
has_alloc_id(&c)
has_alloc_id(&c1)
aligned(s, 1'u64)
aligned(&ARG0, 8'u64)
aligned(&ARG1, 8'u64)
aligned(&c, 1'u64)
aligned(&c1, 1'u64)
aligned(&s[1'u64], 1'u64)
more
good<char*>(s)
good<char*>(&s[1'u64])
-
-
- -
#include "string_buf.c" - -// UTILITIES - -void nonempty_buf_size(char *s, size_t n) -/*@ -requires - take sIn = String_Buf_At(s, n); - chars(sIn) != String_Nil{}; -ensures - take sOut = String_Buf_At(s, n); - sIn == sOut; - n > 1u64; -@*/ -{ - char c = s[0]; - /*@ split_case (c == 0u8); @*/ -} - -void len_lt_buf_size(char *s, size_t n) -/*@ -requires - take sIn = String_Buf_At(s, n); -ensures - take sOut = String_Buf_At(s, n); - sIn == sOut; - string_buf_len(sOut) < n; -@*/ -{ - char c = s[0]; - - if (c == '\0') - { - /*@ unfold string_buf_len(String_Buf {buf_len: n, chars: String_Nil {}}); @*/ - /*@ unfold string_len(String_Nil{});@*/ - } - else - { - char c1 = s[1]; - nonempty_buf_size(s, n); - len_lt_buf_size(&c1, n - (unsigned long long)1); - } -}
-
-
- - - From 6a1ddfa22bf0499444a125264439f6fcc10bdbad Mon Sep 17 00:00:00 2001 From: cassiatorczon Date: Thu, 1 May 2025 02:30:23 -0400 Subject: [PATCH 3/8] cleanup --- src/exercises/string/array.h | 0 src/exercises/string/string.c | 89 ----------------------------------- 2 files changed, 89 deletions(-) delete mode 100644 src/exercises/string/array.h delete mode 100644 src/exercises/string/string.c diff --git a/src/exercises/string/array.h b/src/exercises/string/array.h deleted file mode 100644 index e69de29b..00000000 diff --git a/src/exercises/string/string.c b/src/exercises/string/string.c deleted file mode 100644 index 53e647d8..00000000 --- a/src/exercises/string/string.c +++ /dev/null @@ -1,89 +0,0 @@ -#include -#include "spec_funs.h" - -/*@ -// null-terminated strings with no extra buffer - -predicate (datatype String) String_At(pointer p) { - take h = RW(p); - take s = String_At_Aux(p, h); - return s; -} - -predicate (datatype String) String_At_Aux(pointer p, u8 h) { - if (h == 0u8) { - return String_Nil {}; - } else { - take tl = String_At(array_shift(p, 1u64)); - return String_Cons {head : h, tail : tl}; - } -} - -// function [rec] (u64) string_len(String s) { -// match s { -// String_Nil {} => { 0u64 } -// String_Cons { head : h , tail : tl } => { 1u64 + string_len(tl) } -// } -// } - -// function [rec] (datatype String) string_concat(String s1, String s2) { -// match s1 { -// String_Nil {} => { s2 } -// String_Cons { head : h , tail : tl } => { -// String_Cons { head : h, tail : string_concat(tl, s2) } -// } -// } -// } -@*/ - -// library functions with minimal buffer size arguments - -extern size_t strlen(const char *s); -/*@ spec strlen(pointer s); - requires - take sIn = String_At(s); - ensures - take sOut = String_At(s); - sIn == sOut; - return == string_len(sIn); -@*/ - -extern char *strlcpy(char *dest, const char *src, size_t dest_size); -/*@ spec strlcpy(pointer dest, pointer src, u64 dest_size); - requires - take srcIn = String_At(src); - take destIn = String_Buf_At(dest, dest_size); - string_len(srcIn) < dest_size; // < to leave room for the null - ensures - take srcOut = String_At(src); - take destOut = String_Buf_At(dest, dest_size); - srcIn == srcOut; - destOut == String_Buf { chars : srcIn, buf_len : dest_size }; - ptr_eq(return, dest); -@*/ - -extern int strcmp(char *s1, char *s2); -/*@ spec strcmp(pointer s1, pointer s2); - requires - take s1In = String_At(s1); - take s2In = String_At(s2); - ensures - take s1Out = String_At(s1); - take s2Out = String_At(s2); - s1In == s1Out; - s2In == s2Out; - (return == 0i32) ? s1In == s2In : s1In != s2In; -@*/ - -extern char *strcat(char *dest, const char *src, size_t dest_size); -/*@ spec strcat(pointer dest, pointer src, u64 dest_size); - requires - take srcIn = String_At(src); - take destIn = String_Buf_At(dest, dest_size); - string_len(srcIn) + string_buf_len(destIn) < dest_size; // < to leave room for the null - ensures - take srcOut = String_At(src); - take destOut = String_Buf_At(dest, dest_size); - srcIn == srcOut; - destOut == String_Buf { chars : string_concat(srcIn, chars(destIn)), buf_len : buf_len(destIn) }; -@*/ \ No newline at end of file From 7e31f207bab4abc2e8350f1bce5e4cabe816c448 Mon Sep 17 00:00:00 2001 From: cassiatorczon Date: Sun, 4 May 2025 19:50:30 -0400 Subject: [PATCH 4/8] full simple example --- src/exercises/string/lemmas.c | 158 ++++++++++++++++++++++++++++++++ src/exercises/string/trusted.h | 116 +++++++++++++++++++++++ src/exercises/string/unproven.c | 132 ++++++++++++++++++++++++++ src/exercises/string/unused.c | 83 +++++++++++++++++ 4 files changed, 489 insertions(+) create mode 100644 src/exercises/string/lemmas.c create mode 100644 src/exercises/string/trusted.h create mode 100644 src/exercises/string/unproven.c create mode 100644 src/exercises/string/unused.c diff --git a/src/exercises/string/lemmas.c b/src/exercises/string/lemmas.c new file mode 100644 index 00000000..2bfc3ea8 --- /dev/null +++ b/src/exercises/string/lemmas.c @@ -0,0 +1,158 @@ +#include +#include "trusted.h" + +/* +String lemmas proven in CN. +*/ + +// string length is less than buffer size +void len_lt_buf_size(char *s, size_t n) +/*@ +requires + take sIn = String_Buf_At(s, n); +ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + string_len(sOut) < n; +@*/ +{ + char c = s[0]; + + if (c == '\0') + { + /*@ unfold string_len(sIn); @*/ + } + else + { + len_lt_buf_size(&s[1], n - (unsigned long long)1); + /*@ unfold string_len(sIn);@*/ + } +} + +// nonempty string's length is 1 + its tail's length +void one_plus_string_len(char *s, size_t n) +/*@ +requires + take sIn = String_Buf_At(s, n); + !is_nil_string_buf(sIn); +ensures + take h = RW(s); + take tl = String_Buf_At(array_shift(s, 1u64), n - 1u64); + sIn == String_Buf_Cons { head : h, tail : tl }; + string_len(sIn) == 1u64 + string_len(tl); +@*/ +{ + char c = s[0]; + /*@ split_case (c == 0u8); @*/ + /*@ unfold string_len(sIn); @*/ +} + +// string length is less than max u64 +void string_len_not_max(char *s, size_t n) +/*@ +requires + take sIn = String_Buf_At(s, n); +ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + string_len(sIn) < 18446744073709551615u64; +@*/ +{ + len_lt_buf_size(s, n); +} + +// adding one to less than max u64 does not wrap around +void plus_one_gt_zero(size_t n) +/*@ +requires + n < 18446744073709551615u64; +ensures + 1u64 + n > 0u64; +@*/ +{ +} + +// length of nonempty string is > 0 +void nonempty_string_len(char *s, size_t n) +/*@ +requires + take sIn = String_Buf_At(s, n); + !is_nil_string_buf(sIn); +ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + string_len(sIn) > 0u64; +@*/ +{ + char c = s[0]; + if (c == '\0') + { + /* impossible */ + /*@ assert (false); @*/ + } + else + { + string_len_not_max(&s[1], n - (unsigned long long)1); + len_lt_buf_size(&s[1], n - (unsigned long long)1); + plus_one_gt_zero(str_buf_len(&s[1], n - (unsigned long long)1)); + one_plus_string_len(s, n); + } +} + +// equal strings have the same length +void string_equal_impl_equal_len(char *s1, size_t n1, char *s2, size_t n2) +/*@ +requires + take s1In = String_Buf_At(s1, n1); + take s2In = String_Buf_At(s2, n2); + string_equal(s1In, s2In); +ensures + take s1Out = String_Buf_At(s1, n1); + take s2Out = String_Buf_At(s2, n2); + s1In == s1Out; + s2In == s2Out; + string_len(s1In) == string_len(s2In); +@*/ +{ + char c1 = s1[0]; + char c2 = s2[0]; + if (c1 == '\0') + { + /*@ unfold string_equal(s1In, s2In); @*/ + /*@ unfold string_len(s1In); @*/ + /*@ unfold string_len(s2In); @*/ + } + else + { + /*@ unfold string_equal(s1In, s2In); @*/ + /*@ split_case (c2 == 0u8); @*/ + /*@ unfold string_len(s1In); @*/ + /*@ unfold string_len(s2In); @*/ + string_equal_impl_equal_len(&s1[1], n1 - (unsigned long long)1, &s2[1], n2 - (unsigned long long)1); + } +} + +// all elements of a string are nonzero up to (excluding) string_len +void nonzero_up_to_len(char *s, size_t n) +/*@ +requires + take sIn = String_Buf_At(s, n); +ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + each (u64 i; i < string_len(sIn)) { + string_buf_nth(sIn, i) != 0u8 }; +@*/ +{ + char c = s[0]; + if (c == '\0') + { + /*@ unfold string_len(sIn); @*/ + } + else + { + /*@ unfold string_buf_nth(sIn, 0u64); @*/ + nonzero_up_to_len(&s[1], n - (unsigned long long)1); + /*@ apply nonzero_up_to_len_step(s, n); @*/ + } +} \ No newline at end of file diff --git a/src/exercises/string/trusted.h b/src/exercises/string/trusted.h new file mode 100644 index 00000000..7879d246 --- /dev/null +++ b/src/exercises/string/trusted.h @@ -0,0 +1,116 @@ +#include "string_buf.c" + +/* +Trusted string lemmas. +*/ + +/*@ +lemma array_owned_shift_one_l(pointer s, u64 tail_owned_len) //TODO + +requires + take first = RW(s); + take rest = each (u64 i; i < tail_owned_len) { + RW(array_shift(array_shift(s, 1u64), i))}; + tail_owned_len < 18446744073709551615u64; +ensures + take all = each (u64 i; i < 1u64 + tail_owned_len) { + RW(array_shift(s, i))}; +@*/ + +/*@ +lemma array_blocked_shift_one_l(pointer s, u64 tail_low, u64 tail_high) //TODO + +requires + take blockedIn = each (u64 i; tail_low < i && i < tail_high) { + W(array_shift(array_shift(s, 1u64), i))}; + tail_high < 18446744073709551615u64; +ensures + take blockedOut = each (u64 i; tail_low + 1u64 < i && i < 1u64 + tail_high) { + W(array_shift(s, i))}; +@*/ + +/*@ +lemma array_shift_one_r(pointer s, size_t tail_string_len, size_t tail_buf_len) + +requires + take ownedIn = each (u64 i; i < 1u64 + tail_string_len) { + RW(array_shift(s, i))}; + take blockedIn = each (u64 i; tail_string_len + 1u64 < i && i < 1u64 + tail_buf_len) { + W(array_shift(s, i))}; + tail_string_len < tail_buf_len; + tail_buf_len < 18446744073709551615u64; + take nullIn = RW(array_shift(s, 1u64 + tail_string_len)); + nullIn == 0u8; + each (u64 i; i < 1u64 + tail_string_len) { + ownedIn[i] != 0u8 + }; +ensures + take first = RW(s); + first != 0u8; + take ownedOut = each (u64 i; i < tail_string_len) { + RW(array_shift(array_shift(s, 1u64), i))}; + take blockedOut = each (u64 i; tail_string_len < i && i < tail_buf_len) { + W(array_shift(array_shift(s, 1u64), i))}; + take nullOut = RW(array_shift(array_shift(s, 1u64), tail_string_len)); + nullOut == 0u8; + each (u64 i; i < tail_string_len) { + ownedOut[i] != 0u8 + }; +@*/ + +/*@ +lemma array_to_string_buf(pointer s, u64 n, u64 string_len) +requires + take sArray = each(u64 i; i < string_len) { + RW( array_shift(s, i) ) }; + take sRem = each(u64 i; string_len < i && i < n) { + W( array_shift(s, i)) }; + n >= 1u64; + string_len < n; + take sNull = RW(array_shift(s, string_len)); + sNull == 0u8; + each (u64 i; i < string_len) { + sArray[i] != 0u8 + }; +ensures + take sBuf = String_Buf_At(s, n); + string_len == string_len(sBuf); + each (u64 i; i < string_len(sBuf)) { + string_buf_nth(sBuf, i) == sArray[i] + }; +@*/ + +/*@ +lemma string_buf_to_array(pointer s, u64 n, u64 string_len) //TODO +requires + take sBuf = String_Buf_At(s, n); + string_len(sBuf) == string_len; +ensures + string_len < n; + n >= 1u64; + take sArray = each (u64 i; i < string_len) { + RW( array_shift(s, i) ) }; + take sRem = each (u64 i; string_len < i && i < n) { + W( array_shift(s, i) ) }; + each (u64 i; i < string_len) { + string_buf_nth(sBuf, i) == sArray[i] + }; + take sNull = RW(array_shift(s, string_len)); + sNull == 0u8; +@*/ + +/*@ +lemma nonzero_up_to_len_step(pointer s, size_t n) + +requires + n > 1u64; + take sHead = RW(s); + take sTail = String_Buf_At(array_shift(s, 1u64), n - 1u64); + each (u64 i; i < string_len(sTail)) { + string_buf_nth(sTail, i) != 0u8 }; +ensures + take sOut = String_Buf_At(s, n); + sOut == String_Buf_Cons { head : sHead, tail : sTail }; + each (u64 i; i < string_len(sOut)) { + string_buf_nth(sOut, i) != 0u8 }; +@*/ \ No newline at end of file diff --git a/src/exercises/string/unproven.c b/src/exercises/string/unproven.c new file mode 100644 index 00000000..dab57776 --- /dev/null +++ b/src/exercises/string/unproven.c @@ -0,0 +1,132 @@ +#include +#include "string_buf.c" + +/* +In progress CN versions of trusted lemmas. +*/ + +void array_to_string_buf_c(char *s, size_t string_len, size_t n) +/*@ +requires + take sArray = each(u64 i; i < string_len) { + RW( array_shift(s, i) ) }; + take sRem = each(u64 i; string_len < i && i < n) { + W( array_shift(s, i)) }; + n >= 1u64; + string_len < n; + take sNull = RW(array_shift(s, string_len)); + sNull == 0u8; + // we need some "fix arbitrary i" tactic for the below + each (u64 i; i < string_len) { + sArray[i] != 0u8 + }; +ensures + take sBuf = String_Buf_At(s, n); + string_len == string_len(sBuf); + each (u64 i; i < string_len(sBuf)) { + string_buf_nth(sBuf, i) == sArray[i] + }; +@*/ +{ + /*@ split_case (string_len == 0u64); @*/ + /*@ focus RW, 0u64; @*/ + char c = s[0]; + /*@split_case (c == 0u8); @*/ + if (string_len == (unsigned long long)0) + { + if (c == '\0') + { + /*@ unfold string_len(String_Buf_Nil { empty_buf : n }); @*/ + } + else + { + // impossible + /*@ instantiate 0u64; @*/ + /*@ assert (false); @*/ + } + } + else + { + /*@ apply array_shift_one_r(s, string_len - 1u64, n - 1u64); @*/ + array_to_string_buf_c(&s[1], string_len - (unsigned long long)1, n - (unsigned long long)1); + one_plus_string_len(s, n); + } +} + +void string_buf_to_array_c(char *s, size_t n) +/*@ +requires + take sBuf = String_Buf_At(s, n); +ensures + string_len(sBuf) < n; + n >= 1u64; + take sArray = each (u64 i; i < string_len(sBuf)) { + RW( array_shift(s, i) ) }; + take sRem = each (u64 i; string_len(sBuf) < i && i < n) { + W( array_shift(s, i) ) }; + // we need some "fix arbitrary i" tactic for the below + each (u64 i; i < string_len(sBuf)) { + string_buf_nth(sBuf, i) == sArray[i] + }; + take sNull = RW(array_shift(s, string_len(sBuf))); + sNull == 0u8; +@*/ +{ + char c = s[0]; + if (c == '\0') + { + /*@ unfold string_len(sBuf); @*/ + } + else + { + char c1 = s[1]; + string_buf_to_array_c(&s[1], n - (unsigned long long)1); + /*@ unfold string_len(sBuf); @*/ + /*@ apply array_owned_shift_one_l(s, string_len(sBuf) - 1u64); @*/ + /*@ apply array_blocked_shift_one_l(s, string_len(sBuf) - 1u64, n - 1u64); @*/ + } +} + +/* +In progress potentially-useful functions. +*/ + +// edit any character in the initial string to a non-null character +void edit_at(char *s, size_t buf_len, size_t index, char c) +/*@ +requires + take sIn = String_Buf_At(s, buf_len); + index < string_len(sIn); + c != 0u8; +ensures + take sOut = String_Buf_At(s, buf_len); + // we need some "fix arbitrary i" tactic for the below + each (u64 i; i < string_len(sOut)) { + i == index + ? string_buf_nth(sOut, i) == c + : string_buf_nth(sOut, i) == string_buf_nth(sIn, i) + }; +@*/ +{ + size_t sLen = str_buf_len(s, buf_len); + /*@ apply string_buf_to_array(s, buf_len, string_len(sIn)); @*/ + edit_array_at(s, sLen, index, c); + /*@ instantiate index; @*/ + /*@ apply array_to_string_buf(s, buf_len, sLen); @*/ +} + +// allocate a string of size n and set the first byte to '\0' +char *init_string(size_t n) +/*@ +requires + 1u64 <= n; // 1 byte is required for null termination +ensures + take sOut = String_Buf_At(return, n); + sOut == String_Buf_Nil { empty_buf : n }; +@*/ +{ + char *s = malloc_str(n); + /*@ apply string_buf_to@*/ + s[0] = '\0'; + return s; +} diff --git a/src/exercises/string/unused.c b/src/exercises/string/unused.c new file mode 100644 index 00000000..2f9056ed --- /dev/null +++ b/src/exercises/string/unused.c @@ -0,0 +1,83 @@ +#include +#include "string_buf.c" + +/* +Not used for current example, but potentially useful. +*/ + +/* CN lemmas */ + +// buffer size for a nonempty string is > 1 +void nonempty_buf_size(char *s, size_t n) +/*@ +requires + take sIn = String_Buf_At(s, n); + !is_nil_string_buf(sIn); +ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + n > 1u64; +@*/ +{ + char c = s[0]; + /*@ split_case (c == 0u8); @*/ +} + +// empty string has length 0 +void nil_string_len(char *s, size_t n) +/*@ +requires + take sIn = String_Buf_At(s, n); + is_nil_string_buf(sIn); +ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + string_len(sOut) == 0u64; +@*/ +{ + /*@ unfold string_len(sIn); @*/ +} + +/* Trusted lemmas */ + +/*@ +lemma array_owned_shift_one_r(pointer s, u64 tail_owned_len) //TODO + +requires + take all = each (u64 i; i < 1u64 + tail_owned_len) { + RW(array_shift(s, i))}; + tail_owned_len < 18446744073709551615u64; +ensures + take first = RW(s); + take rest = each (u64 i; i < tail_owned_len) { + RW(array_shift(array_shift(s, 1u64), i))}; +@*/ + +/*@ +lemma array_blocked_shift_one_r(pointer s, u64 tail_low, u64 tail_high) //TODO + +requires + take blockedIn = each (u64 i; tail_low + 1u64 < i && i < 1u64 + tail_high) { + W(array_shift(s, i))}; + tail_high < 18446744073709551615u64; +ensures + take blockedOut = each (u64 i; tail_low < i && i < tail_high) { + W(array_shift(array_shift(s, 1u64), i))}; +@*/ + +/*@ +lemma nonzero_shift_one_r(pointer s, size_t tail_len) + +requires + take sIn = each (u64 i; i < 1u64 + tail_len) { + RW(array_shift(s, i))}; + each (u64 i; i < 1u64 + tail_len) { + sIn[i] != 0u8 + }; +ensures + take sOut = each (u64 i; i < 1u64 + tail_len) { + RW(array_shift(s, i))}; + each (u64 i; i < tail_len) { + sOut[1u64 + i] != 0u8 + }; +@*/ \ No newline at end of file From ce158b95816c9bbbf72d18ccf1d90d41b021d90b Mon Sep 17 00:00:00 2001 From: cassiatorczon Date: Mon, 5 May 2025 19:34:00 -0400 Subject: [PATCH 5/8] writeup --- docs/getting-started/case-studies/strings.md | 125 +++++++++++++++ src/exercises/string/cn_types.h | 43 ++--- src/exercises/string/example.c | 85 +++++----- src/exercises/string/lemmas.c | 158 +++++++++++++++++-- src/exercises/string/lemmas.h | 57 ------- src/exercises/string/spec_funs.h | 86 +++++++--- src/exercises/string/string_buf.c | 22 +-- src/exercises/string/trusted.h | 56 +------ src/exercises/string/unproven.c | 27 +++- src/exercises/string/unused.c | 100 +++++++++++- src/exercises/string/util.c | 59 +++---- 11 files changed, 556 insertions(+), 262 deletions(-) create mode 100644 docs/getting-started/case-studies/strings.md delete mode 100644 src/exercises/string/lemmas.h diff --git a/docs/getting-started/case-studies/strings.md b/docs/getting-started/case-studies/strings.md new file mode 100644 index 00000000..1d90e037 --- /dev/null +++ b/docs/getting-started/case-studies/strings.md @@ -0,0 +1,125 @@ +# Null-terminated strings + +A null-terminated string is an array of characters where the 0 character, +`'\0'`, signals the end of the string. (Note that there is no "null" in the +usual pointer sense, just the byte consisting of all zeros. Note also that this +is distinct from `'0'`.) + +To ensure safety for operations like in-place concatenation, we need to keep +track of not just the string up to `'\0'`, but the entire buffer allocated for +the string. This means our logical representation of strings looks like this: + +```c title="exercises/string/cn_types.h" +--8<-- +exercises/string/cn_types.h +--8<-- +``` + +In order to facilitate proofs, we define logical string buffers inductively. A +string buffer represents either the empty string, in which case we have a +64-bit integer indicating how many unused bytes the buffer has (counting the +null byte as unused), or a nonempty string, in which case we have a (non-null) +character followed by another string buffer. + +Due to CN restrictions on top-level `if`, we have two mutually-recursive +predicates. `String_Buf_At(p, buf_len)` asserts that at the input pointer `p`, +there is a buffer of total size `buf_len` (including the string, the `'\0'` +terminator, and any extra empty bytes), represented by the logical string that +`String_Buf_At` returns. (Note that `buf_len` must be at least 1, to have space +for at least `'\0'`.) `String_Buf_At` reads the first character and, via +`String_Buf_Aux`, checks if it is `'\0'`. If so, it blocks the rest of the +bytes, using `W` instead of `RW` because these bytes have no meaningful data +for us to read yet. If the first byte is not `'\0'`, we recursively call +`String_Buf_At` on the rest of the buffer. + +`spec_funs.h` contains CN functions on the logical representation of string +buffers. Specifically: +* `buf_len` gets the length of the entire allocated buffer for the string +* `string_length` gets the length of the conceptual string, i.e., all the +characters before `'\0'` +* `empty_buf_len` gets the number of bytes after the conceptual string, i.e., +the number of bytes in the buffer starting with the first `'\0'` +* `string_buf_concat` performs in-place concatenation of two strings. It +assumes the destination string has sufficient space +* `string_buf_nth` returns the (0-indexed) nth character of a string, +defaulting to `'\0'` if n is greater than or equal to the length of the +conceptual string +* `is_nil_string_buf` checks if a string buffer represents the empty string +* `string_equal` checks if two string buffers contain equal conceptual strings, +i.e., the buffers may have different total size, but they should contain the +same characters up to and including the first `'\0'` + +`string_buf.c` contains specifications for string functions in the C standard +library. The functions we would like to have available are `malloc`, `free`, +`strlen`, `strcpy`, `strcmp`, and `strcat`. However, to work with our +`String_Buf` type and ensure memory safety, we add additional arguments to +keep track of the lengths of all of the strings' buffers. + +`trusted.h` and `lemmas.c` both contain lemmas about the functions in +`spec_funs.h` and `string_buf.c`. The lemmas in `trusted.h` are trusted, +i.e., not proven in CN, while the ones in `lemmas.c` are proven in CN. +These will be useful for the example function in `example.c`. + +`example.c` contains a toy function designed to use every function in +`string_buf.c` together. It takes a pointer to an input string, the length of +the buffer containing that string, the number of bytes we will allocate for +a second string, and two characters. To make the later copies and comparisons +interesting, we require the input string to be nonempty and the characters +distinct and non-null. We will also later concatenate the strings, so we want +enough space in the buffer we will allocate to fit the input string twice (with +room for a terminating `'\0'` also). We specify this with the constraint +`string_len(sIn) + string_len(sIn) < n2`, and we require the input string to be +sufficiently small that this statement is meaningful, i.e., the `+` is not +wrapping around. + +In the body of our function, we first allocate the second string using +`malloc_str`. Like `malloc`, this does not initialize the bytes in the string to +any specific value. + +Next, we copy the input string into the second string's buffer. Thanks to our +preconditions, we know we have enough space for this. + +After that, we compare the two strings. Because we just copied the first into +the second, the result should be 0; we confirm with `assert` that it is. + +We would now like to edit the first character of each string. We have a safe +wrapper for array edits, `edit_array_at`. This ensures not only that we do +not write beyond the bounds of our array, but also that our edit is meaningful: +we must edit a character within the current defined string, not the empty +buffer space. (If we wanted to extend the string, we would use +`string_buf_cat`.) However, in order to do this, we need to switch from our +`String_Buf` representation of strings to an array representation of strings. + +Luckily, we have a lemma for this, `string_buf_to_array`. When we go to edit +the first array, however, we will need to know that the index at which we are +writing is less than the string length. We are writing at index `0`, so the +lemma that tells us this is `nonempty_string_len`, which asserts that nonempty +strings have positive length. This lemma is stated in terms of our +`String_Buf_At` predicate, so we need to apply it before applying +`string_buf_to_array`. + +This allows us to edit the array, but when we go to convert it back to a +`String_Buf`, we will need additional information. In order for an array to +be a valid string buffer, it must start with some number (potentially 0) of +non-null characters, in this case `s1Len - 1` of them, followed by the null +character, followed by 0 or more write-only bytes. We have a lemma stating +that the first `s1Len - 1` characters of the array are non-null, +`nonzero_up_to_len`, but again, it is stated in terms of `String_Buf` and +`String_Buf_At`, so we must apply it before `string_buf_to_array`. + +We now wish to edit the first character of the second string. Again, we will +need `nonzero_up_to_len` for the conversion back to a `String_Buf`. Before +that, though, how do we know that the length of this second string is positive? +We previously compared it to the first string and got `0`, so we know the two +strings were equal at that point, and we showed that the first string has +nonzero length. That means we can apply `string_equal_impl_equal_len` before +editing the first string to assert that the second string has nonzero length +as well. + +Next, we concatenate the two strings. We know from the lemmas we just applied +and the precondition that the sum of the two strings' lengths is less than +the number of bytes in the second string's buffer, so the in-place +concatenation will not write beyond the end of the buffer. + +Finally, we free the two strings. The only precondition for this is ownership, +so there is nothing to prove. \ No newline at end of file diff --git a/src/exercises/string/cn_types.h b/src/exercises/string/cn_types.h index 3c8305be..ba386b4f 100644 --- a/src/exercises/string/cn_types.h +++ b/src/exercises/string/cn_types.h @@ -1,40 +1,41 @@ -/*@ - -datatype String { - String_Nil {}, - String_Cons { u8 head, datatype String tail} -} - -@*/ +/* +CN string buffer type and predicate. +*/ /*@ // null-terminated strings with (potentially) extra buffer space datatype String_Buf { - String_Buf { - datatype String chars, - size_t buf_len // full buffer length, including chars + String_Buf_Nil { + u64 empty_buf // empty buffer space remaining, including null char + }, + String_Buf_Cons { + u8 head, // should not be 0u8 + datatype String_Buf tail } } -predicate (datatype String_Buf) String_Buf_At(pointer p, size_t buf_len) { - assert (buf_len >= 1u64); +// p: pointer to string buffer +// buf_len: length of *entire* buffer, including string +predicate (datatype String_Buf) String_Buf_At(pointer p, u64 buf_len) { take h = RW(p); - take s = String_Aux(p, buf_len, h); - return String_Buf { chars : s, buf_len : buf_len}; + take s = String_Buf_Aux(p, buf_len, h); + assert (buf_len >= 1u64); // there must be space for at least the null char + return s; } // p: pointer to h -// buf_len: length of buffer including h -// h: first character of string starting at p -predicate (datatype String) String_Aux(pointer p, size_t buf_len, u8 h) { +// buf_len: length of buffer *including* h +// h: first character of string pointed to by p +predicate (datatype String_Buf) String_Buf_Aux(pointer p, u64 buf_len, u8 h) { if (h == 0u8) { - take rem = each (size_t i; 0u64 < i && i < buf_len - 1u64) { + // everything after h can be write-only + take rem = each (u64 i; 0u64 < i && i < buf_len) { W( array_shift(p, i)) }; - return String_Nil {}; + return String_Buf_Nil { empty_buf : buf_len }; } else { take tl_buf = String_Buf_At(array_shift(p, 1u64), buf_len - 1u64); - return String_Cons {head : h, tail : chars(tl_buf)}; + return String_Buf_Cons {head : h, tail : tl_buf}; } } diff --git a/src/exercises/string/example.c b/src/exercises/string/example.c index a0770209..48a48270 100644 --- a/src/exercises/string/example.c +++ b/src/exercises/string/example.c @@ -1,49 +1,52 @@ #include "util.c" -void simple_ex(char *s, unsigned long long n) +/* +Example using string library functions. +*/ + +void simple_ex(char *s1, size_t n1, size_t n2, char c1, char c2) /*@ requires - take sIn = String_Buf_At(s, n); - n < 3u64; + take sIn = String_Buf_At(s1, n1); + !is_nil_string_buf(sIn); + (u128) string_len(sIn) + (u128) string_len(sIn) < (u128) n2; // so it fits in allocated buffer twice + // string_len(sIn) < 9223372036854775808u64; // n1 + n1 < maximum u64 + c1 != c2; + c1 != 0u8; + c2 != 0u8; ensures true; @*/ { - char *sb = malloc_str(5); - unsigned long long m = str_buf_len(sb, 5); - // m == 0 - - /*@ apply len_lt_buf_size(s, n); @*/ - sb = str_buf_cpy(sb, s, 5, n); - - m = str_buf_len(sb, 5); - // m == n - - int j = str_buf_cmp(s, sb, n, 5); - // j == 0 - - /*@ apply string_buf_to_array(s, n); @*/ - /*@ focus RW, 0u64; @*/ - write(s, n, 0, 'c'); - /*@ apply array_to_string_buf(s, n); @*/ - /*@ apply string_buf_to_array(sb, 5u64); @*/ - /*@ focus RW, 0u64; @*/ - write(sb, 5, 0, 'g'); - /*@ apply array_to_string_buf(sb, 5u64); @*/ - - j = str_buf_cmp(s, sb, n, 5); - // j != 0 - - /*@ - unfold string_buf_len(sIn); - assert (string_buf_len(sIn) <= 1u64); - @*/ - sb = str_buf_cat(sb, s, 5, n); - m = str_buf_len(sb, 5); - // m == 2 * n - - free_str(sb, 5); - free_str(s, n); -} - -// parser and printer of pairs of numbers \ No newline at end of file + // allocate second string + char *s2 = malloc_str(n2); + + // copy s1 into s2 + s2 = str_buf_cpy(s2, s1, n2, n1); + + // compare s1 and s2 + int j = str_buf_cmp(s1, s2, n1, n2); + /*@ assert (j == 0i64); @*/ + + // edit s1 + size_t s1Len = str_buf_len(s1, n1); + size_t s2Len = str_buf_len(s2, n2); + nonzero_up_to_len(s1, n1); + nonempty_string_len(s1, n1); + string_equal_impl_equal_len(s1, n1, s2, n2); + /*@ apply string_buf_to_array(s1, n1, s1Len); @*/ + edit_array_at(s1, s1Len, 0, c1); + /*@ apply array_to_string_buf(s1, n1, s1Len); @*/ + + // edit s2 differently + s2Len = str_buf_len(s2, n2); + nonzero_up_to_len(s2, n2); + /*@ apply string_buf_to_array(s2, n2, s2Len); @*/ + edit_array_at(s2, s2Len, 0, c2); + /*@ apply array_to_string_buf(s2, n2, s2Len); @*/ + + s2 = str_buf_cat(s2, s1, n2, n1); + + free_str(s1, n1); + free_str(s2, n2); +} \ No newline at end of file diff --git a/src/exercises/string/lemmas.c b/src/exercises/string/lemmas.c index 2bfc3ea8..c55ea464 100644 --- a/src/exercises/string/lemmas.c +++ b/src/exercises/string/lemmas.c @@ -24,7 +24,7 @@ ensures } else { - len_lt_buf_size(&s[1], n - (unsigned long long)1); + len_lt_buf_size(&s[1], n - (size_t)1); /*@ unfold string_len(sIn);@*/ } } @@ -85,18 +85,11 @@ ensures @*/ { char c = s[0]; - if (c == '\0') - { - /* impossible */ - /*@ assert (false); @*/ - } - else - { - string_len_not_max(&s[1], n - (unsigned long long)1); - len_lt_buf_size(&s[1], n - (unsigned long long)1); - plus_one_gt_zero(str_buf_len(&s[1], n - (unsigned long long)1)); - one_plus_string_len(s, n); - } + /*@ split_case (c == 0u8); @*/ + string_len_not_max(&s[1], n - (size_t)1); + len_lt_buf_size(&s[1], n - (size_t)1); + plus_one_gt_zero(str_buf_len(&s[1], n - (size_t)1)); + one_plus_string_len(s, n); } // equal strings have the same length @@ -125,10 +118,10 @@ ensures else { /*@ unfold string_equal(s1In, s2In); @*/ - /*@ split_case (c2 == 0u8); @*/ /*@ unfold string_len(s1In); @*/ /*@ unfold string_len(s2In); @*/ - string_equal_impl_equal_len(&s1[1], n1 - (unsigned long long)1, &s2[1], n2 - (unsigned long long)1); + /*@ split_case (c2 == 0u8); @*/ + string_equal_impl_equal_len(&s1[1], n1 - (size_t)1, &s2[1], n2 - (size_t)1); } } @@ -152,7 +145,140 @@ ensures else { /*@ unfold string_buf_nth(sIn, 0u64); @*/ - nonzero_up_to_len(&s[1], n - (unsigned long long)1); + nonzero_up_to_len(&s[1], n - (size_t)1); /*@ apply nonzero_up_to_len_step(s, n); @*/ } +} + +void update_empty_buf_preserves_string(char *s, size_t n, size_t new_empty_buf) +/*@ +requires + take sIn = String_Buf_At(s, n); +ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + string_equal(sIn, update_empty_buf(sIn, new_empty_buf)); +@*/ +{ + char c = s[0]; + if (c == '\0') + { + /*@ unfold update_empty_buf(sIn, new_empty_buf); @*/ + /*@ unfold string_equal(sIn, update_empty_buf(sIn, new_empty_buf)); @*/ + } + else + { + update_empty_buf_preserves_string(&s[1], n - (size_t)1, new_empty_buf); + /*@ unfold update_empty_buf(sIn, new_empty_buf); @*/ + /*@ unfold string_equal(sIn, update_empty_buf(sIn, new_empty_buf)); @*/ + } +} + +void update_empty_buf_preserves_len(char *s, size_t n, size_t new_empty_buf) +/*@ +requires + take sIn = String_Buf_At(s, n); +ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + string_len(sIn) == string_len(update_empty_buf(sIn, new_empty_buf)); +@*/ +{ + char c = s[0]; + if (c == '\0') + { + /*@ unfold update_empty_buf(sIn, new_empty_buf); @*/ + /*@ unfold string_len(update_empty_buf(sIn, new_empty_buf)); @*/ + /*@ unfold string_len(sIn); @*/ + } + else + { + update_empty_buf_preserves_len(&s[1], n - (size_t)1, new_empty_buf); + /*@ unfold update_empty_buf(sIn, new_empty_buf); @*/ + /*@ unfold string_len(update_empty_buf(sIn, new_empty_buf)); @*/ + /*@ unfold string_len(sIn); @*/ + } +} + +// void concat_nil_len(char *dest, char *src, size_t dest_size, size_t src_size) +// /*@ +// requires +// take srcIn = String_Buf_At(src, src_size); +// take destIn = String_Buf_At(dest, dest_size); +// is_nil_string_buf(destIn); +// string_len(srcIn) + string_len(destIn) < dest_size; +// ensures +// take srcOut = String_Buf_At(src, src_size); +// take destOut = String_Buf_At(dest, dest_size); +// srcIn == srcOut; +// destIn == destOut; +// string_len(string_buf_concat(destIn, srcIn)) == string_len(srcIn); +// @*/ +// { +// // char c = src[0]; +// // if (c == '\0') +// // { +// // /*@ unfold string_len(srcIn); @*/ +// // /*@ unfold string_len(destIn); @*/ +// // /*@ unfold string_buf_concat(destIn, srcIn); @*/ +// // /*@ unfold string_len(string_buf_concat(destIn, srcIn)); @*/ +// // } +// // else +// // { +// // nonempty_string_len(src, src_size); +// // /*@ unfold string_len(destIn); @*/ +// // /*@ assert (dest_size > 1u64); @*/ +// // concat_nil_len(&dest[1], &src[1], dest_size - (size_t)1, src_size - (size_t)1); +// // } +// } + +/* +// in-place string concat +// assumes destination buffer has enough space for source string +function [rec] (datatype String_Buf) string_buf_concat(String_Buf dest, String_Buf src) { + match dest { + String_Buf_Nil { empty_buf : nDest } => { + // string_len(src) should be strictly less than nDest + update_empty_buf(src, nDest - string_len(src)) + } + String_Buf_Cons { head : h , tail : tl } => { + String_Buf_Cons { head : h, tail : string_buf_concat(tl, src) } + } + } +} + + }*/ + +void concat_len(char *dest, char *src, size_t dest_size, size_t src_size) +/*@ +requires + take srcIn = String_Buf_At(src, src_size); + take destIn = String_Buf_At(dest, dest_size); + let len_sum = string_len(srcIn) + string_len(destIn); + string_len(srcIn) + string_len(destIn) < dest_size; +ensures + take srcOut = String_Buf_At(src, src_size); + take destOut = String_Buf_At(dest, dest_size); + srcIn == srcOut; + destIn == destOut; + string_len(string_buf_concat(destIn, srcIn)) == string_len(srcIn) + string_len(destIn); +@*/ +{ + char c = dest[0]; + if (c == '\0') + { + update_empty_buf_preserves_len(src, src_size, dest_size - str_buf_len(src, src_size)); + /*@ unfold string_len(srcIn); @*/ + /*@ unfold string_len(destIn); @*/ + /*@ unfold string_buf_concat(destIn, srcIn); @*/ + /*@ unfold string_len(string_buf_concat(destIn, srcIn)); @*/ + } + else + { + /*@ unfold string_len(destIn); @*/ + concat_len(&dest[1], src, dest_size - (size_t)1, src_size); + /*@ unfold string_len(srcIn); @*/ + /*@ unfold string_buf_concat(destIn, srcIn); @*/ + /*@ unfold string_len(string_buf_concat(destIn, srcIn)); @*/ + } } \ No newline at end of file diff --git a/src/exercises/string/lemmas.h b/src/exercises/string/lemmas.h deleted file mode 100644 index 43c966b7..00000000 --- a/src/exercises/string/lemmas.h +++ /dev/null @@ -1,57 +0,0 @@ -#include "util.c" - -/*@ -// conversion to and from arrays - -lemma array_to_string_buf(pointer s, size_t n) - requires - take sArray = each(u64 i; i < n) { - RW( array_shift(s, i)) }; - ensures - take sBuf = String_Buf_At(s, n); - each (u64 i; i < string_buf_len(sBuf)) { - string_buf_nth(sBuf, i) == sArray[i] - }; - -lemma string_buf_to_array(pointer s, size_t n) - requires - take sBuf = String_Buf_At(s, n); - ensures - take sArray = each(u64 i; i < n) { - RW( array_shift(s, i)) }; - each (u64 i; i < string_buf_len(sBuf)) { - string_buf_nth(sBuf, i) == sArray[i] - }; - -@*/ - -/*@ -// length lemmas - -lemma len_lt_buf_size (pointer s, size_t n) - requires - take sIn = String_Buf_At(s, n); - ensures - take sOut = String_Buf_At(s, n); - sIn == sOut; - match sOut { - String_Buf { chars : cs, buf_len : n0 } => { - (string_buf_len(sOut) < n0) && (n == n0) - } - }; - -lemma lt_len_impl_nonzero (pointer s, size_t n) - requires - take sBuf = String_Buf_At(s, n); - ensures - take sArray = each(u64 i; i < n) { - RW( array_shift(s, i)) }; - each (u64 i; i < string_buf_len(sBuf)) { - string_buf_nth(sBuf, i) == sArray[i] - }; - each (u64 i; i < string_buf_len(sBuf)) { - sArray[i] != 0u8 - }; - - -@*/ diff --git a/src/exercises/string/spec_funs.h b/src/exercises/string/spec_funs.h index 771ed871..462e5494 100644 --- a/src/exercises/string/spec_funs.h +++ b/src/exercises/string/spec_funs.h @@ -1,53 +1,95 @@ #include "cn_types.h" +/* +Logical string functions for use in specifications. +*/ + /*@ -function (datatype String) chars(String_Buf s) { +// the length of the *entire* buffer, including the string +function [rec] (u64) buf_len(String_Buf s) { match s { - String_Buf { chars : cs, buf_len : n } => { cs } + String_Buf_Nil { empty_buf : n } => { n } + String_Buf_Cons { head : h, tail : tl } => { 1u64 + buf_len(tl) } } } -function (u64) buf_len(String_Buf s) { +// the length of just the string +function [rec] (u64) string_len(String_Buf s) { match s { - String_Buf { chars : cs, buf_len : n } => { n } + String_Buf_Nil { empty_buf : n } => { 0u64 } + String_Buf_Cons { head : h , tail : tl } => { 1u64 + string_len(tl) } } } -function [rec] (u64) string_len(String s) { +// the length of the buffer space *after* the string, including the null +function [rec] (u64) empty_buf_len(String_Buf s) { match s { - String_Nil {} => { 0u64 } - String_Cons { head : h , tail : tl } => { 1u64 + string_len(tl) } + String_Buf_Nil { empty_buf : n } => { n } + String_Buf_Cons { head : h, tail : tl } => { empty_buf_len(tl) } } } -function [rec] (u64) string_buf_len(String_Buf sb) { - match sb { - String_Buf { chars : cs, buf_len : n } => { string_len(cs) } +// updates the number of empty bytes +function [rec] (datatype String_Buf) update_empty_buf(String_Buf s, u64 new_empty_buf) +{ + match s { + String_Buf_Nil { empty_buf : nDest } => { String_Buf_Nil { empty_buf : new_empty_buf } } + String_Buf_Cons { head : h, tail : tl } => { + String_Buf_Cons { head : h, tail : update_empty_buf(tl, new_empty_buf) } + } } } -function [rec] (datatype String) string_concat(String s1, String s2) { - match s1 { - String_Nil {} => { s2 } - String_Cons { head : h , tail : tl } => { - String_Cons { head : h, tail : string_concat(tl, s2) } +// in-place string concat +// assumes destination buffer has enough space for source string +function [rec] (datatype String_Buf) string_buf_concat(String_Buf dest, String_Buf src) { + match dest { + String_Buf_Nil { empty_buf : nDest } => { + // string_len(src) should be strictly less than nDest + update_empty_buf(src, nDest - string_len(src)) + } + String_Buf_Cons { head : h , tail : tl } => { + String_Buf_Cons { head : h, tail : string_buf_concat(tl, src) } } } } // defaults to \0 -function [rec] (u8) string_nth(String s, u64 n) { +function [rec] (u8) string_buf_nth(String_Buf s, u64 n) { match s { - String_Nil {} => { 0u8 } - String_Cons { head : h , tail : tl } => { - n == 0u64 ? h : string_nth(tl, n - 1u64) + String_Buf_Nil { empty_buf : nS } => { 0u8 } + String_Buf_Cons { head : h , tail : tl } => { + n == 0u64 ? h : string_buf_nth(tl, n - 1u64) } } } -function [rec] (u8) string_buf_nth(String_Buf sb, u64 n) { - match sb { - String_Buf { chars : cs, buf_len : n0 } => { string_nth(cs, n) } +// checks if input buffer represents the empty string +function (boolean) is_nil_string_buf(String_Buf s) { + match s { + String_Buf_Nil {empty_buf : n } => { true } + String_Buf_Cons { head : h , tail : tl } => { false } } } + +// compares strings contained in two buffers; does not compare buffer size +function [rec] (boolean) string_equal(String_Buf s1, String_Buf s2) { + match s1 { + String_Buf_Nil { empty_buf : n1 } => { + match s2 { + String_Buf_Nil { empty_buf : n2 } => { true } + String_Buf_Cons { head : h2, tail : tl2 } => { false } + } + } + String_Buf_Cons { head : h1, tail : tl1 } => { + match s2 { + String_Buf_Nil { empty_buf : n2 } => { false } + String_Buf_Cons { head : h2, tail : tl2 } => { + h1 == h2 && string_equal(tl1, tl2) + } + } + } + } +} + @*/ \ No newline at end of file diff --git a/src/exercises/string/string_buf.c b/src/exercises/string/string_buf.c index 38a5092b..47ca9e2c 100644 --- a/src/exercises/string/string_buf.c +++ b/src/exercises/string/string_buf.c @@ -1,10 +1,12 @@ #include #include "spec_funs.h" -// /* NULL-TERMINATED STRING STANDARD LIBRARY FUNCTIONS */ +/* +Specifications for external standard library functions for null-terminated strings. +*/ extern char *malloc_str(size_t n); -/*@ spec malloc_str(size_t n); +/*@ spec malloc_str(u64 n); requires 1u64 <= n; // 1 byte is required for null termination ensures @@ -27,7 +29,7 @@ extern size_t str_buf_len(const char *s, size_t n); ensures take sOut = String_Buf_At(s, n); sIn == sOut; - return == string_buf_len(sIn); + return == string_len(sIn); @*/ // buffer version of strcpy @@ -36,12 +38,13 @@ extern char *str_buf_cpy(char *dest, const char *src, size_t dest_size, size_t s requires take srcIn = String_Buf_At(src, src_size); take destIn = String_Buf_At(dest, dest_size); - string_buf_len(srcIn) < dest_size; // < to leave room for the null + string_len(srcIn) < dest_size; // < to leave room for the null ensures take srcOut = String_Buf_At(src, src_size); take destOut = String_Buf_At(dest, dest_size); srcIn == srcOut; - destOut == String_Buf { chars : chars(srcIn), buf_len : dest_size }; + string_equal(srcOut, destOut); + buf_len(destIn) == buf_len(destOut); ptr_eq(return, dest); @*/ @@ -56,7 +59,7 @@ extern int str_buf_cmp(char *s1, char *s2, size_t n1, size_t n2); take s2Out = String_Buf_At(s2, n2); s1In == s1Out; s2In == s2Out; - (return == 0i32) ? s1In == s2In : s1In != s2In; + (return == 0i32) == string_equal(s1In, s2In); @*/ // buffer version of strcat @@ -65,10 +68,11 @@ extern char *str_buf_cat(char *dest, const char *src, size_t dest_size, size_t s requires take srcIn = String_Buf_At(src, src_size); take destIn = String_Buf_At(dest, dest_size); - string_buf_len(srcIn) + string_buf_len(destIn) < dest_size; // < to leave room for the null + (u128) string_len(srcIn) + (u128) string_len(destIn) < (u128) dest_size; // < to leave room for the null ensures take srcOut = String_Buf_At(src, src_size); take destOut = String_Buf_At(dest, dest_size); srcIn == srcOut; - destOut == String_Buf { chars : string_concat( chars(srcIn), chars(destIn)), buf_len : dest_size}; -@*/ \ No newline at end of file + destOut == string_buf_concat(destIn, srcIn); + ptr_eq(return, dest); +@*/ diff --git a/src/exercises/string/trusted.h b/src/exercises/string/trusted.h index 7879d246..e9af0986 100644 --- a/src/exercises/string/trusted.h +++ b/src/exercises/string/trusted.h @@ -4,60 +4,6 @@ Trusted string lemmas. */ -/*@ -lemma array_owned_shift_one_l(pointer s, u64 tail_owned_len) //TODO - -requires - take first = RW(s); - take rest = each (u64 i; i < tail_owned_len) { - RW(array_shift(array_shift(s, 1u64), i))}; - tail_owned_len < 18446744073709551615u64; -ensures - take all = each (u64 i; i < 1u64 + tail_owned_len) { - RW(array_shift(s, i))}; -@*/ - -/*@ -lemma array_blocked_shift_one_l(pointer s, u64 tail_low, u64 tail_high) //TODO - -requires - take blockedIn = each (u64 i; tail_low < i && i < tail_high) { - W(array_shift(array_shift(s, 1u64), i))}; - tail_high < 18446744073709551615u64; -ensures - take blockedOut = each (u64 i; tail_low + 1u64 < i && i < 1u64 + tail_high) { - W(array_shift(s, i))}; -@*/ - -/*@ -lemma array_shift_one_r(pointer s, size_t tail_string_len, size_t tail_buf_len) - -requires - take ownedIn = each (u64 i; i < 1u64 + tail_string_len) { - RW(array_shift(s, i))}; - take blockedIn = each (u64 i; tail_string_len + 1u64 < i && i < 1u64 + tail_buf_len) { - W(array_shift(s, i))}; - tail_string_len < tail_buf_len; - tail_buf_len < 18446744073709551615u64; - take nullIn = RW(array_shift(s, 1u64 + tail_string_len)); - nullIn == 0u8; - each (u64 i; i < 1u64 + tail_string_len) { - ownedIn[i] != 0u8 - }; -ensures - take first = RW(s); - first != 0u8; - take ownedOut = each (u64 i; i < tail_string_len) { - RW(array_shift(array_shift(s, 1u64), i))}; - take blockedOut = each (u64 i; tail_string_len < i && i < tail_buf_len) { - W(array_shift(array_shift(s, 1u64), i))}; - take nullOut = RW(array_shift(array_shift(s, 1u64), tail_string_len)); - nullOut == 0u8; - each (u64 i; i < tail_string_len) { - ownedOut[i] != 0u8 - }; -@*/ - /*@ lemma array_to_string_buf(pointer s, u64 n, u64 string_len) requires @@ -100,7 +46,7 @@ ensures @*/ /*@ -lemma nonzero_up_to_len_step(pointer s, size_t n) +lemma nonzero_up_to_len_step(pointer s, u64 n) requires n > 1u64; diff --git a/src/exercises/string/unproven.c b/src/exercises/string/unproven.c index dab57776..b7dabff4 100644 --- a/src/exercises/string/unproven.c +++ b/src/exercises/string/unproven.c @@ -32,7 +32,7 @@ ensures /*@ focus RW, 0u64; @*/ char c = s[0]; /*@split_case (c == 0u8); @*/ - if (string_len == (unsigned long long)0) + if (string_len == (size_t)0) { if (c == '\0') { @@ -48,7 +48,7 @@ ensures else { /*@ apply array_shift_one_r(s, string_len - 1u64, n - 1u64); @*/ - array_to_string_buf_c(&s[1], string_len - (unsigned long long)1, n - (unsigned long long)1); + array_to_string_buf_c(&s[1], string_len - (size_t)1, n - (size_t)1); one_plus_string_len(s, n); } } @@ -64,12 +64,12 @@ ensures RW( array_shift(s, i) ) }; take sRem = each (u64 i; string_len(sBuf) < i && i < n) { W( array_shift(s, i) ) }; + take sNull = RW(array_shift(s, string_len(sBuf))); + sNull == 0u8; // we need some "fix arbitrary i" tactic for the below each (u64 i; i < string_len(sBuf)) { string_buf_nth(sBuf, i) == sArray[i] }; - take sNull = RW(array_shift(s, string_len(sBuf))); - sNull == 0u8; @*/ { char c = s[0]; @@ -80,13 +80,30 @@ ensures else { char c1 = s[1]; - string_buf_to_array_c(&s[1], n - (unsigned long long)1); + string_buf_to_array_c(&s[1], n - (size_t)1); /*@ unfold string_len(sBuf); @*/ /*@ apply array_owned_shift_one_l(s, string_len(sBuf) - 1u64); @*/ /*@ apply array_blocked_shift_one_l(s, string_len(sBuf) - 1u64, n - 1u64); @*/ } } +void nonzero_up_to_len_step(char *s, size_t n) +/*@ +requires + n > 1u64; + take sHead = RW(s); + take sTail = String_Buf_At(array_shift(s, 1u64), n - 1u64); + each (u64 i; i < string_len(sTail)) { + string_buf_nth(sTail, i) != 0u8 }; +ensures + take sOut = String_Buf_At(s, n); + sOut == String_Buf_Cons { head : sHead, tail : sTail }; + each (u64 i; i < string_len(sOut)) { + string_buf_nth(sOut, i) != 0u8 }; +@*/ +{ +} + /* In progress potentially-useful functions. */ diff --git a/src/exercises/string/unused.c b/src/exercises/string/unused.c index 2f9056ed..f1545260 100644 --- a/src/exercises/string/unused.c +++ b/src/exercises/string/unused.c @@ -2,7 +2,7 @@ #include "string_buf.c" /* -Not used for current example, but potentially useful. +Not used for current example, but potentially useful, including for `unproven.c`. */ /* CN lemmas */ @@ -38,6 +38,32 @@ ensures /*@ unfold string_len(sIn); @*/ } +void sum_string_parts(char *s, size_t n) +/*@ +requires + take sIn = String_Buf_At(s, n); +ensures + take sOut = String_Buf_At(s, n); + sIn == sOut; + string_len(sIn) + empty_buf_len(sIn) == buf_len(sIn); +@*/ +{ + char c = s[0]; + if (c == '\0') + { + /*@ unfold string_len(sIn); @*/ + /*@ unfold empty_buf_len(sIn); @*/ + /*@ unfold buf_len(sIn); @*/ + } + else + { + sum_string_parts(&s[1], n - (size_t)1); + /*@ unfold string_len(sIn); @*/ + /*@ unfold empty_buf_len(sIn); @*/ + /*@ unfold buf_len(sIn); @*/ + } +} + /* Trusted lemmas */ /*@ @@ -80,4 +106,76 @@ ensures each (u64 i; i < tail_len) { sOut[1u64 + i] != 0u8 }; +@*/ + +/*@ +lemma array_owned_shift_one_l(pointer s, u64 tail_owned_len) + +requires + take first = RW(s); + take rest = each (u64 i; i < tail_owned_len) { + RW(array_shift(array_shift(s, 1u64), i))}; + tail_owned_len < 18446744073709551615u64; +ensures + take all = each (u64 i; i < 1u64 + tail_owned_len) { + RW(array_shift(s, i))}; +@*/ + +/*@ +lemma array_blocked_shift_one_l(pointer s, u64 tail_low, u64 tail_high) //TODO + +requires + take blockedIn = each (u64 i; tail_low < i && i < tail_high) { + W(array_shift(array_shift(s, 1u64), i))}; + tail_high < 18446744073709551615u64; +ensures + take blockedOut = each (u64 i; tail_low + 1u64 < i && i < 1u64 + tail_high) { + W(array_shift(s, i))}; +@*/ + +/*@ +lemma array_shift_one_r(pointer s, size_t tail_string_len, size_t tail_buf_len) + +requires + take ownedIn = each (u64 i; i < 1u64 + tail_string_len) { + RW(array_shift(s, i))}; + take blockedIn = each (u64 i; tail_string_len + 1u64 < i && i < 1u64 + tail_buf_len) { + W(array_shift(s, i))}; + tail_string_len < tail_buf_len; + tail_buf_len < 18446744073709551615u64; + take nullIn = RW(array_shift(s, 1u64 + tail_string_len)); + nullIn == 0u8; + each (u64 i; i < 1u64 + tail_string_len) { + ownedIn[i] != 0u8 + }; +ensures + take first = RW(s); + first != 0u8; + take ownedOut = each (u64 i; i < tail_string_len) { + RW(array_shift(array_shift(s, 1u64), i))}; + take blockedOut = each (u64 i; tail_string_len < i && i < tail_buf_len) { + W(array_shift(array_shift(s, 1u64), i))}; + take nullOut = RW(array_shift(array_shift(s, 1u64), tail_string_len)); + nullOut == 0u8; + each (u64 i; i < tail_string_len) { + ownedOut[i] != 0u8 + }; +@*/ + +/*@ +lemma convert_to_write_only(pointer s, size_t n, size_t string_len, size_t index) + +requires + n >= 1u64; + string_len < n; + index <= string_len; + take rwIn = each (u64 i; i <= string_len) { + RW(array_shift(s, i)) }; + take wIn = each (u64 i; string_len < i && i < n) { + W(array_shift(s, i)) }; +ensures + take rwOut = each (u64 i; i < index) { + RW(array_shift(s, i)) }; + take wOut = each (u64 i; index <= i && i < n) { + W(array_shift(s, i)) }; @*/ \ No newline at end of file diff --git a/src/exercises/string/util.c b/src/exercises/string/util.c index b4fea416..77cdc73b 100644 --- a/src/exercises/string/util.c +++ b/src/exercises/string/util.c @@ -1,43 +1,32 @@ -#include "string_buf.c" +#include +#include "lemmas.c" -// UTILITIES +/* +Library functions for null-terminated strings. +*/ -void nonempty_buf_size(char *s, size_t n) +// edit any character up to (not including) string_len +void edit_array_at(char *s, size_t string_len, size_t index, char c) /*@ requires - take sIn = String_Buf_At(s, n); - chars(sIn) != String_Nil{}; + take sIn = each (u64 i; i < string_len) { + RW(array_shift(s, i)) + }; + take sNullIn = RW(array_shift(s, string_len)); + index < string_len; ensures - take sOut = String_Buf_At(s, n); - sIn == sOut; - n > 1u64; + take sOut = each (u64 i; i < string_len) { + RW(array_shift(s, i)) + }; + each (u64 i; i < string_len) { + i == index + ? sOut[i] == c + : sOut[i] == sIn[i] + }; + take sNullOut = RW(array_shift(s, string_len)); + sNullOut == sNullIn; @*/ { - char c = s[0]; - /*@ split_case (c == 0u8); @*/ -} - -void len_lt_buf_size(char *s, size_t n) -/*@ -requires - take sIn = String_Buf_At(s, n); -ensures - take sOut = String_Buf_At(s, n); - sIn == sOut; - string_buf_len(sOut) < n; -@*/ -{ - char c = s[0]; - - if (c == '\0') - { - /*@ unfold string_buf_len(String_Buf {buf_len: n, chars: String_Nil {}}); @*/ - /*@ unfold string_len(String_Nil{});@*/ - } - else - { - char c1 = s[1]; - nonempty_buf_size(s, n); - len_lt_buf_size(&c1, n - (unsigned long long)1); - } + /*@ focus RW, index; @*/ + s[index] = c; } \ No newline at end of file From f0f1358cb9a54c1ecd71d35996cade9fd65d187f Mon Sep 17 00:00:00 2001 From: cassiatorczon Date: Tue, 6 May 2025 04:41:42 -0400 Subject: [PATCH 6/8] cleanup --- src/exercises/string/example.c | 3 +- src/exercises/string/lemmas.c | 108 +++++---------------------------- src/exercises/string/unused.c | 10 +-- 3 files changed, 20 insertions(+), 101 deletions(-) diff --git a/src/exercises/string/example.c b/src/exercises/string/example.c index 48a48270..d9208632 100644 --- a/src/exercises/string/example.c +++ b/src/exercises/string/example.c @@ -10,7 +10,6 @@ void simple_ex(char *s1, size_t n1, size_t n2, char c1, char c2) take sIn = String_Buf_At(s1, n1); !is_nil_string_buf(sIn); (u128) string_len(sIn) + (u128) string_len(sIn) < (u128) n2; // so it fits in allocated buffer twice - // string_len(sIn) < 9223372036854775808u64; // n1 + n1 < maximum u64 c1 != c2; c1 != 0u8; c2 != 0u8; @@ -26,7 +25,7 @@ void simple_ex(char *s1, size_t n1, size_t n2, char c1, char c2) // compare s1 and s2 int j = str_buf_cmp(s1, s2, n1, n2); - /*@ assert (j == 0i64); @*/ + /*@ assert (j == 0i32); @*/ // edit s1 size_t s1Len = str_buf_len(s1, n1); diff --git a/src/exercises/string/lemmas.c b/src/exercises/string/lemmas.c index c55ea464..1d20d992 100644 --- a/src/exercises/string/lemmas.c +++ b/src/exercises/string/lemmas.c @@ -33,18 +33,21 @@ ensures void one_plus_string_len(char *s, size_t n) /*@ requires - take sIn = String_Buf_At(s, n); - !is_nil_string_buf(sIn); + n > 1u64; + take hIn = RW(s); + hIn != 0u8; + take tlIn = String_Buf_At(array_shift(s, 1u64), n - 1u64); ensures - take h = RW(s); - take tl = String_Buf_At(array_shift(s, 1u64), n - 1u64); - sIn == String_Buf_Cons { head : h, tail : tl }; - string_len(sIn) == 1u64 + string_len(tl); + take hOut = RW(s); + hOut != 0u8; + take tlOut = String_Buf_At(array_shift(s, 1u64), n - 1u64); + hIn == hOut; + tlIn == tlOut; + string_len(String_Buf_Cons { head : hIn, tail : tlIn }) == 1u64 + string_len(tlIn); @*/ { - char c = s[0]; - /*@ split_case (c == 0u8); @*/ - /*@ unfold string_len(sIn); @*/ + /*@ split_case (hIn == 0u8); @*/ + /*@ unfold string_len(String_Buf_Cons { head : hIn, tail : tlIn }); @*/ } // string length is less than max u64 @@ -55,7 +58,7 @@ requires ensures take sOut = String_Buf_At(s, n); sIn == sOut; - string_len(sIn) < 18446744073709551615u64; + string_len(sIn) < MAXu64(); @*/ { len_lt_buf_size(s, n); @@ -65,7 +68,7 @@ ensures void plus_one_gt_zero(size_t n) /*@ requires - n < 18446744073709551615u64; + n < MAXu64(); ensures 1u64 + n > 0u64; @*/ @@ -198,87 +201,4 @@ ensures /*@ unfold string_len(update_empty_buf(sIn, new_empty_buf)); @*/ /*@ unfold string_len(sIn); @*/ } -} - -// void concat_nil_len(char *dest, char *src, size_t dest_size, size_t src_size) -// /*@ -// requires -// take srcIn = String_Buf_At(src, src_size); -// take destIn = String_Buf_At(dest, dest_size); -// is_nil_string_buf(destIn); -// string_len(srcIn) + string_len(destIn) < dest_size; -// ensures -// take srcOut = String_Buf_At(src, src_size); -// take destOut = String_Buf_At(dest, dest_size); -// srcIn == srcOut; -// destIn == destOut; -// string_len(string_buf_concat(destIn, srcIn)) == string_len(srcIn); -// @*/ -// { -// // char c = src[0]; -// // if (c == '\0') -// // { -// // /*@ unfold string_len(srcIn); @*/ -// // /*@ unfold string_len(destIn); @*/ -// // /*@ unfold string_buf_concat(destIn, srcIn); @*/ -// // /*@ unfold string_len(string_buf_concat(destIn, srcIn)); @*/ -// // } -// // else -// // { -// // nonempty_string_len(src, src_size); -// // /*@ unfold string_len(destIn); @*/ -// // /*@ assert (dest_size > 1u64); @*/ -// // concat_nil_len(&dest[1], &src[1], dest_size - (size_t)1, src_size - (size_t)1); -// // } -// } - -/* -// in-place string concat -// assumes destination buffer has enough space for source string -function [rec] (datatype String_Buf) string_buf_concat(String_Buf dest, String_Buf src) { - match dest { - String_Buf_Nil { empty_buf : nDest } => { - // string_len(src) should be strictly less than nDest - update_empty_buf(src, nDest - string_len(src)) - } - String_Buf_Cons { head : h , tail : tl } => { - String_Buf_Cons { head : h, tail : string_buf_concat(tl, src) } - } - } -} - - }*/ - -void concat_len(char *dest, char *src, size_t dest_size, size_t src_size) -/*@ -requires - take srcIn = String_Buf_At(src, src_size); - take destIn = String_Buf_At(dest, dest_size); - let len_sum = string_len(srcIn) + string_len(destIn); - string_len(srcIn) + string_len(destIn) < dest_size; -ensures - take srcOut = String_Buf_At(src, src_size); - take destOut = String_Buf_At(dest, dest_size); - srcIn == srcOut; - destIn == destOut; - string_len(string_buf_concat(destIn, srcIn)) == string_len(srcIn) + string_len(destIn); -@*/ -{ - char c = dest[0]; - if (c == '\0') - { - update_empty_buf_preserves_len(src, src_size, dest_size - str_buf_len(src, src_size)); - /*@ unfold string_len(srcIn); @*/ - /*@ unfold string_len(destIn); @*/ - /*@ unfold string_buf_concat(destIn, srcIn); @*/ - /*@ unfold string_len(string_buf_concat(destIn, srcIn)); @*/ - } - else - { - /*@ unfold string_len(destIn); @*/ - concat_len(&dest[1], src, dest_size - (size_t)1, src_size); - /*@ unfold string_len(srcIn); @*/ - /*@ unfold string_buf_concat(destIn, srcIn); @*/ - /*@ unfold string_len(string_buf_concat(destIn, srcIn)); @*/ - } } \ No newline at end of file diff --git a/src/exercises/string/unused.c b/src/exercises/string/unused.c index f1545260..a2123c73 100644 --- a/src/exercises/string/unused.c +++ b/src/exercises/string/unused.c @@ -72,7 +72,7 @@ lemma array_owned_shift_one_r(pointer s, u64 tail_owned_len) //TODO requires take all = each (u64 i; i < 1u64 + tail_owned_len) { RW(array_shift(s, i))}; - tail_owned_len < 18446744073709551615u64; + tail_owned_len < MAXu64(); ensures take first = RW(s); take rest = each (u64 i; i < tail_owned_len) { @@ -85,7 +85,7 @@ lemma array_blocked_shift_one_r(pointer s, u64 tail_low, u64 tail_high) //TODO requires take blockedIn = each (u64 i; tail_low + 1u64 < i && i < 1u64 + tail_high) { W(array_shift(s, i))}; - tail_high < 18446744073709551615u64; + tail_high < MAXu64(); ensures take blockedOut = each (u64 i; tail_low < i && i < tail_high) { W(array_shift(array_shift(s, 1u64), i))}; @@ -115,7 +115,7 @@ requires take first = RW(s); take rest = each (u64 i; i < tail_owned_len) { RW(array_shift(array_shift(s, 1u64), i))}; - tail_owned_len < 18446744073709551615u64; + tail_owned_len < MAXu64(); ensures take all = each (u64 i; i < 1u64 + tail_owned_len) { RW(array_shift(s, i))}; @@ -127,7 +127,7 @@ lemma array_blocked_shift_one_l(pointer s, u64 tail_low, u64 tail_high) //TODO requires take blockedIn = each (u64 i; tail_low < i && i < tail_high) { W(array_shift(array_shift(s, 1u64), i))}; - tail_high < 18446744073709551615u64; + tail_high < MAXu64(); ensures take blockedOut = each (u64 i; tail_low + 1u64 < i && i < 1u64 + tail_high) { W(array_shift(s, i))}; @@ -142,7 +142,7 @@ requires take blockedIn = each (u64 i; tail_string_len + 1u64 < i && i < 1u64 + tail_buf_len) { W(array_shift(s, i))}; tail_string_len < tail_buf_len; - tail_buf_len < 18446744073709551615u64; + tail_buf_len < MAXu64(); take nullIn = RW(array_shift(s, 1u64 + tail_string_len)); nullIn == 0u8; each (u64 i; i < 1u64 + tail_string_len) { From 7bb77496a39c58a6b964caf8710ab3a4b0597779 Mon Sep 17 00:00:00 2001 From: cassiatorczon Date: Tue, 6 May 2025 04:50:21 -0400 Subject: [PATCH 7/8] marked unproven as broken --- .../{unproven.c => more_lemmas.broken.c} | 38 ++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) rename src/exercises/string/{unproven.c => more_lemmas.broken.c} (75%) diff --git a/src/exercises/string/unproven.c b/src/exercises/string/more_lemmas.broken.c similarity index 75% rename from src/exercises/string/unproven.c rename to src/exercises/string/more_lemmas.broken.c index b7dabff4..7fbdf971 100644 --- a/src/exercises/string/unproven.c +++ b/src/exercises/string/more_lemmas.broken.c @@ -1,5 +1,5 @@ #include -#include "string_buf.c" +#include "lemmas.c" /* In progress CN versions of trusted lemmas. @@ -147,3 +147,39 @@ ensures s[0] = '\0'; return s; } + +void concat_len(char *dest, char *src, size_t dest_size, size_t src_size) +/*@ +requires + take srcIn = String_Buf_At(src, src_size); + take destIn = String_Buf_At(dest, dest_size); + (u128) string_len(srcIn) + (u128) string_len(destIn) < (u128) dest_size; +ensures + take srcOut = String_Buf_At(src, src_size); + take destOut = String_Buf_At(dest, dest_size); + srcIn == srcOut; + destIn == destOut; + string_len(string_buf_concat(destIn, srcIn)) == string_len(srcIn) + string_len(destIn); +@*/ +{ + char c = dest[0]; + if (c == '\0') + { + update_empty_buf_preserves_len(src, src_size, dest_size - str_buf_len(src, src_size)); + /*@ unfold string_len(srcIn); @*/ + /*@ unfold string_len(destIn); @*/ + /*@ unfold string_buf_concat(destIn, srcIn); @*/ + /*@ unfold string_len(string_buf_concat(destIn, srcIn)); @*/ + } + else + { + /*@ split_case (c == 0u8); @*/ + /*@ unfold string_len(destIn); @*/ + /*@ assert (string_len(destIn) > 0u64); @*/ + one_plus_string_len(dest, dest_size); + concat_len(&dest[1], src, dest_size - (size_t)1, src_size); + /*@ unfold string_len(srcIn); @*/ + /*@ unfold string_buf_concat(destIn, srcIn); @*/ + /*@ unfold string_len(string_buf_concat(destIn, srcIn)); @*/ + } +} \ No newline at end of file From 149433b78ef7205e9859f9fbb87974e12b17963a Mon Sep 17 00:00:00 2001 From: cassiatorczon Date: Tue, 6 May 2025 04:52:51 -0400 Subject: [PATCH 8/8] updated comment --- src/exercises/string/unused.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/exercises/string/unused.c b/src/exercises/string/unused.c index a2123c73..505b04c7 100644 --- a/src/exercises/string/unused.c +++ b/src/exercises/string/unused.c @@ -2,7 +2,7 @@ #include "string_buf.c" /* -Not used for current example, but potentially useful, including for `unproven.c`. +Not used for current example, but potentially useful, including for `more_lemmas.broken.c`. */ /* CN lemmas */