val field
  (#l: P.union_typ)
  (tgs: tags l)
  (p: P.pointer (typ l))
  (f: P.struct_field l)
: HST.Stack (P.pointer (P.typ_of_struct_field l f))
  (requires (fun h ->
    valid h tgs p /\
    gread_tag h tgs p == normalize_term (tag_of_field tgs f)
  ))
  (ensures (fun h0 p' h1 ->
    h0 == h1 /\
    field_matches_tag tgs f (gread_tag h0 tgs p) /\
    p' == gfield tgs p f
  ))
let field
  (#l: P.union_typ)
  (tgs: tags l)
  (p: P.pointer (typ l))
  (f: P.struct_field l)
: HST.Stack (P.pointer (P.typ_of_struct_field l f))
  (requires (fun h ->
    valid h tgs p /\
    gread_tag h tgs p == normalize_term (tag_of_field tgs f)
  ))
  (ensures (fun h0 p' h1 ->
    h0 == h1 /\
    field_matches_tag tgs f (gread_tag h0 tgs p) /\
    p' == gfield tgs p f
  ))
= P.ufield (P.field p (union_field l)) f
val field
  (#l: P.union_typ)
  (tgs: tags l)
  (p: P.pointer (typ l))
  (f: P.struct_field l)
: HST.Stack (P.pointer (P.typ_of_struct_field l f))
  (requires (fun h ->
    valid h tgs p /\
    gread_tag h tgs p == normalize_term (tag_of_field tgs f)
  ))
  (ensures (fun h0 p' h1 ->
    h0 == h1 /\
    field_matches_tag tgs f (gread_tag h0 tgs p) /\
    p' == gfield tgs p f
  ))
let field (#l: P.union_typ) (tgs: tags l) (p: P.pointer (typ l)) (f: P.struct_field l)
    : HST.Stack (P.pointer (P.typ_of_struct_field l f))
      (requires (fun h -> valid h tgs p /\ gread_tag h tgs p == normalize_term (tag_of_field tgs f))
      )
      (ensures
        (fun h0 p' h1 ->
            h0 == h1 /\ field_matches_tag tgs f (gread_tag h0 tgs p) /\ p' == gfield tgs p f)) =
P.ufield (P.field p (union_field l)) f
FStar.TaggedUnion.fst.checked
prims.fst.checked FStar.UInt32.fsti.checked FStar.Pointer.fst.checked FStar.Pervasives.Native.fst.checked FStar.Pervasives.fsti.checked FStar.List.Tot.fst.checked FStar.HyperStack.ST.fsti.checked FStar.HyperStack.fst.checked
FStar.TaggedUnion.fst
FStar.Pointer.Base.union_typ FStar.TaggedUnion.tags FStar.Pointer.Base.pointer FStar.TaggedUnion.typ FStar.Pointer.Base.struct_field FStar.Pointer.Base.ufield FStar.Pointer.Base.typ_of_struct_field FStar.Pointer.Base.TUnion FStar.Pointer.Base.field FStar.TaggedUnion.typ_l FStar.TaggedUnion.union_field FStar.Monotonic.HyperStack.mem Prims.l_and FStar.TaggedUnion.valid Prims.eq2 FStar.UInt32.t FStar.TaggedUnion.gread_tag FStar.Pervasives.normalize_term FStar.TaggedUnion.tag_of_field FStar.TaggedUnion.field_matches_tag FStar.TaggedUnion.gfield
(*
   Copyright 2008-2018 Microsoft Research

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
*)
module FStar.TaggedUnion

module P = FStar.Pointer
module HS = FStar.HyperStack
module HST = FStar.HyperStack.ST

(** Code of a tagged union *)

let typ_l (l: P.union_typ) = {
  P.name = "__tagged__" ^ l.P.name;
  P.fields = P.([("tag", TBase TUInt32); ("union", TUnion l)]);
}

let tag_field (l: P.union_typ) : P.struct_field (typ_l l) = "tag"
let union_field (l: P.union_typ) : P.struct_field (typ_l l) = "union"

let typ (l: P.union_typ) : P.typ = P.TStruct (typ_l l)

(******************************************************************************)

(* Tagging, at the logical level *)

(* Abstract predicate providing a proof that some field matches some tag. *)

let field_matches_tag
  (#l: P.union_typ) (tgs: tags l)
  (f: P.struct_field l) (t: UInt32.t)
: Tot Type0
= tag_of_field tgs f == t

let rec field_of_tag_of_field'
  (#l: P.struct_typ')
  (tgs: tags' l)
  (f: P.struct_field' l)
: Lemma (field_of_tag' #l tgs (tag_of_field' #l tgs f) == f)
  [SMTPat (field_of_tag' #l tgs (tag_of_field' #l tgs f))]
= let ((f', _) :: l') = l in
  let (t' :: tgs') = tgs in
  if f = f' then ()
  else (
    let ff : string = f in
    field_of_tag_of_field' #l' tgs' ff
  )

let field_of_tag_of_field
  (#l: P.union_typ)
  (tgs: tags l)
  (f: P.struct_field l)
: Lemma (field_of_tag #l tgs (tag_of_field #l tgs f) == f)
  [SMTPat (field_of_tag #l tgs (tag_of_field #l tgs f))]
= field_of_tag_of_field' tgs f

let rec tag_of_field_of_tag'
  (#l: P.struct_typ')
  (tgs: tags' l)
  (t: UInt32.t)
: Lemma
  (requires (List.Tot.mem t tgs))
  (ensures (
    List.Tot.mem t tgs /\
    tag_of_field' #l tgs (field_of_tag' #l tgs t) == t
  ))
  [SMTPat (tag_of_field' #l tgs (field_of_tag' #l tgs t))]
= let ((f', _) :: l') = l in
  let (t' :: tgs') = tgs in
  if t = t' then ()
  else (
    tag_of_field_of_tag' #l' tgs' t
  )

let tag_of_field_of_tag
  (#l: P.union_typ)
  (tgs: tags l)
  (t: UInt32.t)
: Lemma
  (requires (List.Tot.mem t tgs))
  (ensures (
    List.Tot.mem t tgs /\
    tag_of_field #l tgs (field_of_tag #l tgs t) == t
  ))
  [SMTPat (tag_of_field #l tgs (field_of_tag #l tgs t))]
= tag_of_field_of_tag' tgs t

let field_matches_tag_intro
  (#l: P.union_typ) (tgs: tags l)
  (f: P.struct_field l) (t: UInt32.t)
: Lemma
  (requires (tag_of_field tgs f == t))
  (ensures (field_matches_tag tgs f t))
= ()

let field_matches_tag_elim
  (#l: P.union_typ) (tgs: tags l)
  (f: P.struct_field l) (t: UInt32.t)
: Lemma
  (requires (field_matches_tag tgs f t))
  (ensures (tag_of_field tgs f == t))
= ()

let assert_field_matches_tag
  (#l: P.union_typ) (tgs: tags l)
  (f: P.struct_field l) (t: UInt32.t)
: Lemma
  (requires (normalize_term (tag_of_field tgs f) == t))
  (ensures (field_matches_tag tgs f t))
= ()

(******************************************************************************)

(* Stateful invariant *)

let valid
  (#l: P.union_typ)
  (h: HS.mem)
  (tgs: tags l)
  (p: P.pointer (typ l))
: GTot Type0
=
  let tag_ptr = P.gfield p (tag_field l) in
  let u_ptr = P.gfield p (union_field l) in
  let t = P.gread h tag_ptr in
  P.readable h tag_ptr /\
  List.Tot.mem t tgs /\
  (let f = field_of_tag #l tgs t in
   P.is_active_union_field h u_ptr f)

let valid_live
  (#l: P.union_typ)
  (h: HS.mem)
  (tgs: tags l)
  (p: P.pointer (typ l))
: Lemma (requires (valid h tgs p))
        (ensures (P.live h p))
  [SMTPat (valid h tgs p)]
= ()

(******************************************************************************)

(* Operations *)

let gread_tag
  (#l: P.union_typ)
  (h: HS.mem)
  (tgs: tags l)
  (p: P.pointer (typ l))
: GTot UInt32.t
= P.gread h (P.gfield p (tag_field l))

let read_tag
  (#l: P.union_typ)
  (tgs: tags l)
  (p: P.pointer (typ l))
: HST.Stack UInt32.t
  (requires (fun h -> valid h tgs p))
  (ensures (fun h0 t h1 ->
    h0 == h1 /\
    List.Tot.mem t tgs /\
    t == gread_tag h0 tgs p))
= P.read (P.field p (tag_field l))


let gfield
  (#l: P.union_typ)
  (tgs: tags l)
  (p: P.pointer (typ l))
  (f: P.struct_field l)
: GTot (p': P.pointer (P.typ_of_struct_field l f) { P.includes p p' })
= P.gufield (P.gfield p (union_field l)) f


let field
  (#l: P.union_typ)
  (tgs: tags l)
  (p: P.pointer (typ l))
  (f: P.struct_field l)
: HST.Stack (P.pointer (P.typ_of_struct_field l f))
  (requires (fun h ->
    valid h tgs p /\
    gread_tag h tgs p == normalize_term (tag_of_field tgs f)
  ))
  (ensures (fun h0 p' h1 ->
    h0 == h1 /\
    field_matches_tag tgs f (gread_tag h0 tgs p) /\
    p' == gfield tgs p f
val field
  (#l: P.union_typ)
  (tgs: tags l)
  (p: P.pointer (typ l))
  (f: P.struct_field l)
: HST.Stack (P.pointer (P.typ_of_struct_field l f))
  (requires (fun h ->
    valid h tgs p /\
    gread_tag h tgs p == normalize_term (tag_of_field tgs f)
  ))
  (ensures (fun h0 p' h1 ->
    h0 == h1 /\
    field_matches_tag tgs f (gread_tag h0 tgs p) /\
    p' == gfield tgs p f
  ))

    tgs: FStar.TaggedUnion.tags l ->
    p: FStar.Pointer.Base.pointer (FStar.TaggedUnion.typ l) ->
    f: FStar.Pointer.Base.struct_field l
  -> FStar.HyperStack.ST.Stack
    (FStar.Pointer.Base.pointer (FStar.Pointer.Base.typ_of_struct_field l f))