val as_seq'_sel' (#a #b: _)
                 (v:view a b)
                 (es:Seq.seq a)
                 (i:nat{i < Seq.length es * View?.n v})
  : Lemma
     (ensures (
       as_seq'_len es v;
       sel' v es i == Seq.index (as_seq' es v) i))
     (decreases (Seq.length es))
let rec as_seq'_sel' #a #b v es i =
  as_seq'_len es v;
  let n : pos = View?.n v in
  assert (i / n < Seq.length es);
  if Seq.length es = 0 then ()
  else let bs = as_seq' es v in
       assert (Seq.length bs = n + Seq.length (as_seq' (Seq.tail es) v));
       if (i < n) then
         begin
           assert (Seq.index bs i == Seq.index (View?.get v (Seq.head es)) i)
         end
       else
         begin
           let as' = Seq.tail es in
           as_seq'_len as' v;
           let j = i - n in
           assert (j / n < Seq.length as');
           assert (j < Seq.length (as_seq' as' v));
           as_seq'_sel' v as' j;
           assert (sel' v as' j == Seq.index (as_seq' as' v) j);
           assert (Seq.index (as_seq' es v) i ==
                   Seq.index (as_seq' as' v) j);
           sel'_tail v es i
         end
val as_seq'_sel' (#a #b: _)
                 (v:view a b)
                 (es:Seq.seq a)
                 (i:nat{i < Seq.length es * View?.n v})
  : Lemma
     (ensures (
       as_seq'_len es v;
       sel' v es i == Seq.index (as_seq' es v) i))
     (decreases (Seq.length es))
let rec as_seq'_sel' #a #b v es i =
as_seq'_len es v;
let n:pos = View?.n v in
assert (i / n < Seq.length es);
if Seq.length es = 0
then ()
else
  let bs = as_seq' es v in
  assert (Seq.length bs = n + Seq.length (as_seq' (Seq.tail es) v));
  if (i < n)
  then assert (Seq.index bs i == Seq.index (View?.get v (Seq.head es)) i)
  else
    let as' = Seq.tail es in
    as_seq'_len as' v;
    let j = i - n in
    assert (j / n < Seq.length as');
    assert (j < Seq.length (as_seq' as' v));
    as_seq'_sel' v as' j;
    assert (sel' v as' j == Seq.index (as_seq' as' v) j);
    assert (Seq.index (as_seq' es v) i == Seq.index (as_seq' as' v) j);
    sel'_tail v es i
LowStar.BufferView.Down.fst.checked
prims.fst.checked LowStar.Monotonic.Buffer.fsti.checked FStar.Seq.fst.checked FStar.Pervasives.fsti.checked FStar.Mul.fst.checked FStar.Math.Lemmas.fst.checked FStar.HyperStack.ST.fsti.checked FStar.HyperStack.fst.checked FStar.Classical.fsti.checked
LowStar.BufferView.Down.fst
LowStar.BufferView.Down.view FStar.Seq.Base.seq Prims.nat Prims.b2t Prims.op_LessThan FStar.Mul.op_Star FStar.Seq.Base.length LowStar.BufferView.Down.__proj__View__item__n Prims.op_Equality Prims.int Prims.bool Prims._assert Prims.eq2 FStar.Seq.Base.index LowStar.BufferView.Down.__proj__View__item__get FStar.Seq.Properties.head LowStar.BufferView.Down.sel'_tail Prims.unit LowStar.BufferView.Down.as_seq' LowStar.BufferView.Down.sel' LowStar.BufferView.Down.as_seq'_sel' Prims.op_Division Prims.op_Subtraction LowStar.BufferView.Down.as_seq'_len FStar.Seq.Properties.tail Prims.op_Addition Prims.pos
(*
   Copyright 2008-2018 Microsoft Research

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
*)
module LowStar.BufferView.Down
open LowStar.Monotonic.Buffer
open FStar.Mul
module HS=FStar.HyperStack
module B=LowStar.Monotonic.Buffer
module Math=FStar.Math.Lemmas

#set-options "--smtencoding.elim_box true"
#set-options "--smtencoding.l_arith_repr native"
#set-options "--smtencoding.nl_arith_repr wrapped"
#set-options "--z3rlimit_factor 4" //just being conservative
#set-options "--initial_fuel 1 --max_fuel 1"

noeq
type buffer_view (src:Type0) (rrel rel:B.srel src) (dest:Type u#b) : Type u#b =
  | BufferView: buf:B.mbuffer src rrel rel
              -> v:view src dest
              -> buffer_view src rrel rel dest

let mk_buffer_view (#src:Type0) (#rrel #rel:B.srel src) (#dest:Type)
                   (b:B.mbuffer src rrel rel)
                   (v:view src dest)
   : GTot (buffer dest)
   = (| src, rrel, rel, BufferView b v |)

let as_buffer (#b:Type) (v:buffer b) =
  let (| _, _, _, BufferView b _ |) = v in
  b

let as_buffer_mk_buffer_view
       (#src:Type0) (#rrel #rel:B.srel src) (#dest:Type)
       (b:B.mbuffer src rrel rel)
       (v:view src dest) =
   ()

let get_view  (#b : Type) (bv:buffer b) =
  let (| _, _, _, BufferView _ v |) = bv in
  v

let get_view_mk_buffer_view
       (#src:Type0) (#rrel #rel:B.srel src) (#dest:Type)
       (b:B.mbuffer src rrel rel)
       (v:view src dest)
  = ()

let length (#b: _) (vb:buffer b) =
  let b = as_buffer vb in
  let v = get_view vb in
  B.length b * View?.n v

let length_eq (#b: _) (vb:buffer b) = ()

let indexing' (#a #b: _) (v:view a b) (len_as:nat) (i:nat{i < len_as * View?.n v})
  : Lemma (let n = View?.n v in
           let vlen = len_as * n in
           n * (i / n) < vlen  /\
           n * (i / n) + n <= vlen)
  = let n = View?.n v in
    let vlen = len_as * n in
    assert (n * (i / n) < vlen);
    assert (i / n <= len_as - 1)

let indexing #b vb i = indexing' (get_view vb) (B.length (as_buffer vb)) i

let sel' (#a #b: _) (v:view a b)
         (es:Seq.seq a)
         (i:nat{i / View?.n v < Seq.length es})
   : GTot b
   = let n = View?.n v in
     let a_i = i / n in
     let bs = View?.get v (Seq.index es a_i) in
     Seq.index bs (i % n)

let sel (#b: _)
        (h:HS.mem)
        (vb:buffer b)
        (i:nat{i < length vb})
   : GTot b
   = indexing vb i;
     let es = B.as_seq h (as_buffer vb) in
     let v = get_view vb in
     sel' v es i

let lemma_g_upd_with_same_seq (#a:Type0) (#rrel #rel:srel a) (b:mbuffer a rrel rel) (h:HS.mem{B.live h b}) (s:_)
  : Lemma (Seq.equal s (B.as_seq h b) ==>
           B.g_upd_seq b s h == h)
  = B.lemma_g_upd_with_same_seq b h

let mods (#b: _)
             (vb:buffer b)
             (h h':HS.mem)
    = B.modifies (B.loc_buffer (as_buffer vb)) h h'

val upd' (#b: _)
        (h:HS.mem)
        (vb:buffer b{live h vb})
        (i:nat{i < length vb})
        (x:b)
  : GTot (h':HS.mem{
           (indexing vb i;
            let b = as_buffer vb in
            let v = get_view vb in
            let n = View?.n v in
            let a_i = i / n in
            B.as_seq h' b ==
            Seq.upd (B.as_seq h b) a_i (Seq.index (B.as_seq h' b) a_i)) /\
            sel h' vb i == x /\
            (forall (j:nat{j< length vb}). i<>j ==> sel h' vb j == sel h vb j) /\
            (x == sel h vb i ==> h == h') /\
            mods vb h h' /\
            live h' vb /\
            FStar.HyperStack.ST.equal_domains h h'
          })
#push-options "--z3rlimit_factor 8"
let upd' #b h vb i x =
    indexing vb i;
    let es = B.as_seq h (as_buffer vb) in
    let v = get_view vb in
    let n = View?.n v in
    let a_i = i / n in
    let bs = View?.get v (Seq.index es a_i) in
    let bs' = Seq.upd bs (i % n) x in
    assert (x == sel h vb i ==> Seq.equal bs bs');
    let a' = View?.put v bs' in
    let mem = B.g_upd (as_buffer vb) a_i a' h in
    B.g_upd_seq_as_seq (as_buffer vb) (Seq.upd es a_i a') h;
    lemma_g_upd_with_same_seq (as_buffer vb) h (Seq.upd es a_i a');
    mem
#pop-options

let upd = upd'
let sel_upd #b vb i j x h = ()
let lemma_upd_with_sel #b vb i h = ()
let upd_modifies #b h vb i x = ()
let upd_equal_domains #b h vb i x = ()

let rec seq_fold_right_gtot #a #b (s:Seq.seq a) (f:a -> b -> GTot b) (acc:b)
  : GTot b (decreases (Seq.length s))
  = if Seq.length s = 0 then acc
    else f (Seq.head s) (seq_fold_right_gtot (Seq.tail s) f acc)

let cons_view #a #b (v:view a b) (x:a) (tl:Seq.seq b) : GTot (Seq.seq b) =
  Seq.append (View?.get v x) tl

let as_seq' (#a #b:_) (es:Seq.seq a) (v:view a b) : GTot (Seq.seq b) =
  seq_fold_right_gtot #a #(Seq.seq b) es (cons_view #a #b v) Seq.empty

let rec as_seq'_len (#a #b:_) (es:Seq.seq a) (v:view a b)
  : Lemma (ensures (Seq.length (as_seq' es v) == View?.n v * Seq.length es))
          (decreases (Seq.length es))
  = if Seq.length es = 0 then ()
    else as_seq'_len (Seq.tail es) v

let rec as_seq'_injective #a #b (v:view a b) (as1 as2:Seq.seq a)
  : Lemma
      (requires as_seq' as1 v `Seq.equal` as_seq' as2 v)
      (ensures  as1 `Seq.equal` as2)
      (decreases (Seq.length as1))
  = as_seq'_len as1 v;
    as_seq'_len as2 v;
    assert (Seq.length as1 == Seq.length as2);
    if Seq.length as1 = 0 then ()
    else let n = View?.n v in
         as_seq'_len (Seq.tail as1) v;
         as_seq'_len (Seq.tail as2) v;
         Seq.lemma_append_inj
               (View?.get v (Seq.head as1))
               (as_seq' (Seq.tail as1) v)
               (View?.get v (Seq.head as2))
               (as_seq' (Seq.tail as2) v);
         as_seq'_injective v (Seq.tail as1) (Seq.tail as2);
         assert (as1 `Seq.equal` (Seq.head as1 `Seq.cons` Seq.tail as1));
         assert (as2 `Seq.equal` (Seq.head as2 `Seq.cons` Seq.tail as2))

let as_seq #b h vb =
  let (| a, _, _, BufferView buf v |) = vb in
  let es = B.as_seq h buf in
  let bs = as_seq' #a #b es v in
  as_seq'_len es v;
  bs

#push-options "--max_ifuel 0"
val sel'_tail (#a #b:_) (v:view a b) (es:Seq.seq a{Seq.length es > 0})
              (i:nat{View?.n v <= i /\ i < Seq.length es * View?.n v})
  : Lemma (let j = i - View?.n v in
           sel' v es i == sel' v (Seq.tail es) j)
let sel'_tail #a #b v es i =
  let len_as = Seq.length es in
  indexing' v len_as i;
  let n = View?.n v in
  let j = i - n in
  let a_i = i / n in
  assert (sel' v es i == Seq.index (View?.get v (Seq.index es a_i)) (i % n));
  FStar.Math.Lemmas.lemma_mod_sub i n 1;
  FStar.Math.Lemmas.add_div_mod_1 j n;
  assert (j / n == (i / n) - 1)

val as_seq'_sel' (#a #b: _)
                 (v:view a b)
                 (es:Seq.seq a)
                 (i:nat{i < Seq.length es * View?.n v})
  : Lemma
     (ensures (
       as_seq'_len es v;
       sel' v es i == Seq.index (as_seq' es v) i))
     (decreases (Seq.length es))

//flaky
#reset-options
#set-options "--smtencoding.elim_box true"
#set-options "--smtencoding.l_arith_repr native"
#set-options "--smtencoding.nl_arith_repr wrapped"
#set-options "--z3rlimit_factor 10" //just being conservative
#set-options "--initial_fuel 1 --max_fuel 1 --max_ifuel 0"
val as_seq'_sel' (#a #b: _)
                 (v:view a b)
                 (es:Seq.seq a)
                 (i:nat{i < Seq.length es * View?.n v})
  : Lemma
     (ensures (
       as_seq'_len es v;
       sel' v es i == Seq.index (as_seq' es v) i))
     (decreases (Seq.length es))

    v: LowStar.BufferView.Down.view a b ->
    es: FStar.Seq.Base.seq a ->
    i: Prims.nat{i < FStar.Seq.Base.length es * View?.n v}
  -> FStar.Pervasives.Lemma
      (ensures
        ([@@ FStar.Pervasives.inline_let ]let _ = LowStar.BufferView.Down.as_seq'_len es v in
          LowStar.BufferView.Down.sel' v es i ==
          FStar.Seq.Base.index (LowStar.BufferView.Down.as_seq' es v) i))
      (decreases FStar.Seq.Base.length es)