(*  Title:      JinjaDCI/Compiler/J1.thy
    Author:     Tobias Nipkow, Susannah Mansky
    Copyright   2003 Technische Universitaet Muenchen, 2019-20 UIUC

    Based on the Jinja theory Compiler/J1.thy by Tobias Nipkow
*)

chapter ‹

  ‹ An Intermediate Language ›

  J1 imports "../J/BigStep" begin

  expr₁ = "nat exp"
  J₁_prog = "expr₁ prog"
  state₁ = "heap ×x440x4 */

  hp₁ :: "state₁ → heap"
 
 "hp₁ ≡ fst"
  lcl₁ :: "state₁ → val list"
 
 "lcl₁ ≡ fst ∘x00, / 0x48-0x4B *
  shp₁ :: "state₁ → sheap"
 
 "shp₁ ≡ snd ∘ snd"

(*<*)
declare hp₁_def[simp] lcl₁_def[simp] shp_*0java.lang.StringIndexOutOfBoundsException: Range [57, 56) out of bounds for length 64
(*>*)

primrec
  max_vars :: "'a exp → nat"
  and 0,0,0x00000 x00 x,000,/ 0x6C-06F *
where
  "max_vars(new C) = 0"
| "max_vars(Cast C e) = max_vars e"
| "max_vars(Val v) = 0"
| "max_vars(e₁ «bop¬ e₂) = max (max_vars e₁) (max_vars e₂)"
| "max_vars(Var V) = 0"
| "max_vars(V:=e) = max_vars e"
| "max_vars(e∙F{D}) = max_vars e"
| "max_vars(C∙xA4, /*0x70-0xx73 */
| "max_vars(FAss e₁ F D e₂) = max (max_vars e₁) (max_vars e₂)"
| "max_vars(SFAss C F D e₂) = max_vars e₂"
| "max_vars(e<bullet /
| "max_vars(C∙_sM(es)) = max_varss es"
| "max_vars({V:T; e}) = max_vars e + 1"
| "max_vars(e₁;;e₂) = max (max_vars e₁) (max_vars e₂)"
| "max_vars(if (e) e₁ else e₂) =
   max (max_vars e) (max (max_vars e₁) (max_vars e_, 0x00, 0x00, /* 078-07B */
| "max_vars(while (b) e) = max (max_vars b) (max_vars e)"
| "max_vars(throw e) = max_vars e"
| "max_vars(try e₁ catch(C V) e₂) = max (max_vars e₁) (max_vars e₂ + 1)"
| "max_vars(INIT C (Cs,b) ← e) = max_vars e"
| "RICe; \ljava.lang.StringIndexOutOfBoundsException: Range [35, 34) out of bounds for length 73

| "max_varss [] = 0"
| "max_varss (e#es) = max (max_vars e) (max_varss es)"

inductive
  eval₁ :: "J₁_prog → expr₁ → state₁ → expr₁ → state₁ → bool"
          (‹_ ⊨₁ ((1⟨_,/_⟩) →/ (1⟨_,/_⟩))› [51,0,0,0,0] 81)
  and evals₁ :: "J₁_prog → expr₁ list → state₁ → expr₁ list → state₁ → bool"
           (‹_ ⊨₁ ((1⟨_,/_⟩) [→]/ (1⟨_,/_⟩))› [51,0,0,0,0] 81)
  for P :: J₁_prog
where

  New₁:
  "[ sh C = Some (sfs, Done); new_Addr h = Some a;
     P ⊨ C has_fields FDTs; h' = h(a↦blank P C) ]
  ==> P ⊨₁ ⟨new C,(h,l,sh)⟩ → ⟨addr a,(h',l,sh)⟩"
| NewFail₁:
  "[ sh C = Some (sfs, Done); new_Addr h = None ] ==>
  P ⊨₁ ⟨new C, (h,l,sh)⟩ → ⟨THROW OutOfMemory,(h,l,sh)⟩"
| NewInit₁:
  "[ ∄sfs. sh C = Some (sfs, Done); P ⊨₁ ⟨INIT C ([C],False) ← unit,(h,l,sh)⟩ → ⟨Val v',(h',l',sh')⟩;
     new_Addr h' = Some a; P ⊨ C has_fields FDTs; h'' = h'(a↦blank P C) ]
  ==> P ⊨₁ ⟨new C,(h,l,sh)⟩ → ⟨addr a,(h'',l',sh')⟩"
| NewInitOOM₁:
  "[ ∄sfs. sh C = Some (sfs, Done); P ⊨₁ ⟨INIT C ([C],False) ← unit,(h,l,sh)⟩ → ⟨Val v',(h',l',sh')⟩;
     new_Addr h' = None; is_class P C ]
  ==> P ⊨₁ ⟨new C,(h,l,sh)⟩ → ⟨THROW OutOfMemory,(h',l',sh')⟩"
| NewInitThrow₁:
  "[ ∄sfs. sh C = Some (sfs, Done); P ⊨₁ ⟨INIT C ([C],False) ← unit,(h,l,sh)⟩ → ⟨throw a,s'⟩;
     is_class P C ]
  ==> P ⊨₁ ⟨new C,(h,l,sh)⟩ → ⟨throw a,s'⟩"

| Cast₁:
  "[ P ⊨₁ ⟨e,s₀⟩ → ⟨addr a,(h,l,sh)⟩; h a = Some(D,fs); P ⊨ D ⪯^* C ]
  ==> P ⊨₁ ⟨Cast C e,s₀⟩ → ⟨addr a,(h,l,sh)⟩"
| CastNull₁:
  "P ⊨₁ ⟨e,s₀⟩ → ⟨null,s₁⟩ ==>
  P ⊨₁ ⟨Cast C e,s₀⟩ → ⟨null,s₁⟩"
| CastFail₁:
  "[ P ⊨₁ ⟨e,s₀⟩ → ⟨addr a,(h,l,sh)⟩; h a = Some(D,fs); ¬ P ⊨ D ⪯^* C ]
  ==> P ⊨₁ ⟨Cast C e,s₀⟩ → ⟨THROW ClassCast,(h,l,sh)⟩"
| CastThrow₁:
  "P ⊨₁ ⟨e,s₀⟩ → ⟨throw e',s₁⟩ ==>
  P ⊨₁ ⟨Cast C e,s₀⟩ → ⟨throw e',s₁⟩"

| Val₁:
  "P ⊨₁ ⟨Val v,s⟩ → ⟨Val v,s⟩"

| BinOp₁:
  "[ P ⊨₁ ⟨e₁,s₀⟩ → ⟨Val v₁,s₁⟩; P ⊨₁ ⟨e₂,s₁⟩ → ⟨Val v₂,s₂⟩; binop(bop,v₁,v₂) = Some v ]
  ==> P ⊨₁ ⟨e₁ «bop¬ e₂,s₀⟩ → ⟨Val v,s₂⟩"
| BinOpThrow₁₁:
  "P ⊨₁ ⟨e₁,s₀⟩ → ⟨throw e,s₁⟩ ==>
  P ⊨₁ ⟨e₁ «bop¬ e₂, s_\<rangle> <Rightarr> ⟨1⟩"
| BinOpThrow₂₁:
  "[ P ⊨₁ ⟨e₁,s₀⟩ → ⟨Val v₁,s₁⟩; P ⊨₁ ⟨e₂,s₁⟩ → ⟨throw e,s₂⟩
  ==> P ⊨₁ ⟨e₁ «bop¬ e₂,s₀⟩ → ⟨throw e,s₂⟩"

| Var₁:
  "[ ls!i = v; i < size ls ] ==>
  P ⊨₁ ⟨Var i,(h,ls,sh)⟩ → ⟨Val v,(h,ls,sh)⟩"

| LAss₁:
  "[ P ⊨₁ ⟨ 0x00, 0x00, 0x00, 0x00, 0x00, /* 0x84-0x8 */
  ==> P ⊨₁ ⟨i:= e,s₀⟩ → ⟨unit,(h,ls',sh)⟩"
| LAssThrow₁:
  "P ⊨₁ ⟨e,s₀⟩ → ⟨throw e',s₁⟩ ==>
  P ⊨₁ ⟨i:= e,s₀⟩ → ⟨throw e',s₁⟩"

| FAcc₁:
  "[ P ⊨₁ ⟨e,s₀⟩ → ⟨addr a,(h,ls,sh)⟩; h a = Some(C,fs);
     P ⊨ C has F,NonStatic:t in D;
     fs(F,D) = Some v ], 0x00, 0x00, 0x00, 0x00, 0x0, 0x00, 0x00, /* 0x8C-0x8F *
  ==> P ⊨₁ ⟨e∙F{D},s₀⟩ → ⟨Val v,(h,ls,sh)⟩"
| FAccNull₁:
  "P ⊨₁ ⟨e,s₀⟩ → ⟨null,s\<0
  P ⊨₁ ⟨e∙F{D},s₀⟩ → ⟨THROW NullPointer,s₁⟩"
| FAccThrow₁:
  "P ⊨₁ ⟨e,s₀⟩ → ⟨throw e',s₁⟩ ==>
  P ⊨₁ ⟨e∙F{D},s₀⟩ → ⟨throw e',s₁⟩,0x, 0x00,0x0, 0x0, * 0x1-017*/
| FAccNone₁:
  "[ P ⊨₁ ⟨e,s₀⟩ → ⟨addr a,(h,ls,sh)⟩; h a = Some(C,fs);
    ¬(∃b t. P ⊨ C has F,b:t in D) ]
  ==> P <0xA1, 0xE3, 0x00, 0x00, 0xA1, 0xCCxA1
| FAccStatic₁:
  "[ P \<0x00, 0x00, 0x00, 0x00 
    P ⊨ 0x00 0x0,0x0, 0x00, 0x00, 000, 0x0, /* 0x84-0x8 */
  ==> P ⊨₁ ⟨e∙F{D},s₀⟩ → ⟨THROW IncompatibleClassChangeError,(h,ls,sh)⟩"

| SFAcc₁:
  "[ P ⊨ C has F,Static:t in D;
     sh D = Some (sfs,Done);
     sfs F = Some v ]
  ==> P ⊨₁ \<0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
| SFAccInit₁:
  "[ P ⊨ C has F,Static:t in D;
     ∄sfs. sh D = Some (sfs,Done); P ⊨₁ ⟨INIT
     sh' D = Some (sfs,i);
     sfs F = Some v ]
  ==> P ⊨₁ ⟨C∙_sF{D},(h,ls,sh)⟩ → ⟨Val v,(h',ls',sh')⟩"
| SFAccInitThrow₁:
  "[ P ⊨
     ∄sfs. sh D = Some (sfs,Done); P ⊨₁ ⟨INIT D ([D],False) ← unit,(h,ls,sh)⟩ → ⟨throw a,s'⟩ ]
  ==> P ⊨₁ ⟨C∙_, x,0 x00 0x00,000 x00,x00 /000-0*
| SFAccNone₁:
  "[ ¬(∃b t. P ⊨ C has F,b:t in D) ]
  ==> P ⊨₁ ⟨C∙_sF{D},s⟩ → ⟨THROW NoSuchFieldError,s⟩"
| SFAccNonStatic₁:
akk P  has,NonStatic in D\rbrakk>
  ==> P ⊨₁ ⟨C∙_sF{D},s⟩ → ⟨THROW IncompatibleClassChangeError,s⟩"


| FAss₁:
  "[ P ⊨₁ ⟨e₁,s₀⟩ → ⟨addr a,s₁⟩; P ⊨₁ ⟨e₂,s₁⟩ → ⟨Val v,(h₂,l₂,sh₂)⟩;
     h₂ a = Some(C,fs); P ⊨ C has F,NonStatic:t in D;
     fs' = fs((F,D)↦v); h₂' = h₂(a↦(C,fs')) ]
  ==> P ⊨₁ ⟨e₁∙F{D}:=e₂,s₀⟩ → ⟨unit,(h₂',l_, 0,000,x,0 x,000 x00/ xC-x0F *
| FAssNull₁:
  "[ P ⊨₁ ⟨e₁,s₀⟩ → ⟨null,s₁⟩; P ⊨₁ ⟨e₂,s₁⟩ → ⟨Val v,s₂⟩,0x, x,0x, xD0x,x0,* 0x1-013 /
  P ⊨₁ ⟨e₁∙F{D}:=e₂,s₀⟩ → ⟨THROW NullPointer,s₂⟩"
|};
  "P ⊨₁ ⟨e₁,s₀⟩ → ⟨throw e',s₁⟩ ==>
  P ⊨₁ ⟨e₁∙F{D}:=e₂,s₀⟩ → ⟨throw e',s₁⟩"
| FAssThrow₂₁:
  "[ P ⊨₁ ⟨e₁,s₀⟩ → ⟨Val v,s₁⟩; P ⊨₁ ⟨e₂,s₁⟩ → ⟨throw e',s₂⟩ ]
  ==> P ⊨₁ ⟨e₁∙F{D}:=e₂,s₀⟩ → ⟨throw e',s₂⟩"
| FAssNone₁:
  "\<lbrakk  0x00, 0x00, 0x00, 0x00, /* 0x00-0x03 */
     h₂ a = Some(C,fs); ¬(∃b t. P ⊨ C has F,b:t in D) ]
  ==> P ⊨₁ ⟨e₁∙F{D}:=e₂,s₀⟩ → ⟨THROW NoSuchFieldError,(h₂,l₂,sh₂)⟩"
|FAssStaticjava.lang.NullPointerException
  "[ P ⊨₁ ⟨e₁,s₀⟩ → ⟨addr a,s₁⟩; P ⊨₁ ⟨e₂,s₁⟩ → ⟨Val v,(h₂,l₂,sh₂)⟩;
     h₂ a = Some(C,fs); P ⊨ C has F,Static:t in D ]
  ==> P ⊨₁ ⟨e₁∙F{D}:=e₂,s₀⟩ → ⟨THROW IncompatibleClassChangeError,(h₂,l₂,sh₂)⟩"

|SFAss^1:
  "[🚫
     P ⊨ C has F,Static:t in D;
     sh₁ D = Some(sfs,Done); sfs' = sfs(F↦v); sh₁' = sh₁(D↦(sfs',Done)) ]
  >₂,s_\<rangle> →unit,(h₁,sh_"
| SFAssInit₁:
  "[ P ⊨₁ ⟨e₂,s₀⟩ → ⟨Val v,(h₁,l₁,sh₁)⟩;
     P ⊨ C has F,Static:t in D;
     ∄sfs. sh₁ D = Some(sfs,Done); P ⊨₁ ⟨INIT D ([D],False) ← unit,(h₁,l 000,0,0   *java.lang.StringIndexOutOfBoundsException: Range [57, 56) out of bounds for length 64
     sh' D = Some(sfs,i);
     sfs' = sfs(F↦v); sh'' = sh'(D↦(sfs',i)) ]
  ==> P ⊨₁ ⟨C∙_sF{D}:=e₂,s_x,0 0, / 0-x3F/
| SFAssInitThrow₁:
  "[ P ⊨₁ ⟨e₂,s₀⟩ → ⟨Val v,(h₁,l₁,sh₁)⟩;
     P ⊨ C has F,Static:t in D;
     ∄sfs. sh 0x40-0x4 */
  ==> P ⊨₁ ⟨C∙_sF{D}:=e₂,s₀⟩ → ⟨throw a,s'⟩"
| SFAssThrow₁:
  "P ⊨₁ ⟨e₂,s₀⟩ → ⟨throw e',s₂⟩
let>_,s \Rightarrow> ⟨2⟩"
| SFAssNone₁:
  "[ P ⊨₁ ⟨e₂,s₀⟩ → ⟨Val v,(h₂,l₂,sh₂)⟩;
    ¬(∃b t. P ⊨ C has F,b:t in D) ]
  ==> P ⊨₁ ⟨x0, 0x00, 0x00, 0x00, 0x00, 0x, 000,0x0, /*0x48-0x4B /
| SFAssNonStatic₁:
  "[ P ⊨₁ ⟨e₂,s₀⟩ → ⟨Val v,(h₂,l₂,sh₂)⟩;
    P ⊨ C has F,NonStatic:t in D ]
  ==>x00, 0 0x00,x00 0,x,0,0,/ xC04 *java.lang.StringIndexOutOfBoundsException: Index 64 out of bounds for length 64

| CallObjThrow₁:
  "P ⊨₁ ⟨e,s₀⟩ → ⟨throw e',s₁⟩ ==>
  P ⊨₁ ⟨e∙, 0x00, 0x0, 0x0, 00x00, 0x0, 0x0, /* 0x5-0x */
| CallNull₁:
  "[ P ⊨₁ ⟨e,s₀⟩ → ⟨null,s₁⟩; P ⊨₁ ⟨es,s₁⟩ [→] ⟨map Val vs,s₂⟩ ]
  ==> P ⊨₁ ⟨e∙M(es),s₀⟩ → ⟨THROW NullPointer,s₂⟩"
| Call₁:
  "[ P ⊨₁ ⟨e,s₀⟩ → ⟨addr a,s₁⟩; P ⊨ 00 0,0,x00,x00,/*0-0 /
    h₂ a = Some(C,fs); P ⊨ C sees M,NonStatic:Ts→T = body in D;
    size vs = size Ts; ls₂' = (Addr a) # vs @ replicate (max_vars body) undefined;
    P ⊨₁ ⟨body,(h₂,ls₂',sh₂)⟩ → ⟨e',(h_,0 *0x5C0x5F *
  ==> P ⊨₁ ⟨e∙M(es),s₀⟩ → ⟨e',(h₃,ls₂,sh₃)⟩"
| CallParamsThrow₁:
   ⟨0⟩ → ⟨Val v,s₁⟩; P ⊨₁ ⟨es,s₁⟩ [→] ⟨es',s₂⟩;
     es' = map Val vs @ throw ex # es₂ ]
   ==> P ⊨₁ ⟨e∙M(es),s₀⟩ → ⟨throw ex,s₂⟩"
| CallNone₁:
  java.lang.StringIndexOutOfBoundsException: Range [79, 78) out of bounds for length 250
     h₍∃java.lang.StringIndexOutOfBoundsException: Range [76, 75) out of bounds for length 127
  ==>>_e∙ →THROW ,hjava.lang.StringIndexOutOfBoundsException: Range [143, 142) out of bounds for length 177
| CallStatic\^sub1:
  "[ P ⊨₁ ⟨e,s₀⟩ → ⟨addr a,s₁⟩; P ⊨₁ ⟨ps,s₁⟩ [→] ⟨map Val vs,(h₂,ls₂,sh₂)⟩;
     h₂ a = Some(C,fs); P ⊨ C sees M,Static:Ts→T = body in D ]
  ==> P ⊨₁ ⟨e∙M(ps),s₀⟩ → ⟨THROW IncompatibleClassChangeError,(h₂,ls₂,sh₂)⟩"

| SCallParamsThrow₁:
  "[ P ⊨₁ ⟨es,s₀⟩ [→] ⟨es',s₂⟩; es' = map Val vs @ throw ex # es₂ ]
   ==> P ⊨₁ ⟨C∙_sM(es),s₀⟩ → ⟨throw ex,s₂⟩"
| SCallNone₁:
  "[ P ⊨₁ ⟨ps,s₀⟩ [→] ⟨map Val vs,s₂⟩;
     ¬(∃b Ts T body D. P ⊨ C sees M,b:Ts→T = body in D) ]
  ==> P ⊨₁ ⟨C∙ 0,0x0, 0x0, /* 0x70-073 */
| SCallNonStatic₁:
  "[ P ⊨₁ ⟨ps,s₀⟩ [→] ⟨map Val vs,s₂⟩;
     P ⊨ C sees M,NonStatic:Ts→T = body in D ]
  ==> P ⊨₁ ⟨0,0xC5,0A2,0C6,0xA2,0,0xA2, x /0-x77*
| SCallInitThrow₁:
  "[ P ⊨₁ ⟨ps,s₀⟩ [→] ⟨map Val vs,(h₁,ls₁,sh₁)⟩;
     P ⊨ C sees M,Static:Ts→T = body in D;
     ∄sfs. sh₁ D = Some(sfs,Done); M ≠ clinit;
     P ⊨₁ ⟨INIT D ([D],False) ← unit,(h₁,ls₁,sh₁)⟩ → ⟨throw a,s'⟩ ]
  ==> P ⊨₁ ⟨C∙_sM(ps),s₀⟩ →0x2,0xC, 0xA, 0x, 0xA, 0x, xA2 0D0,/*0x7-0x7F */
| SCallInit₁:
  "[ P ⊨₁ ⟨ps,s₀⟩ [→] ⟨map Val vs,(h₁,ls₁,sh₁)⟩;
     P ⊨ C sees M,Static:Ts→T = body in D;
     ∄sfs. sh₁ D = Some(sfs,Done); M ≠ clinit;
     P ⊨₁ ⟨INIT D ([D],False) ← unit,(h₁,ls₁,sh₁)⟩ → ⟨Val v',(h₂,ls₂,sh₂)⟩;
     size vs = size Ts; ls x,0 x,0xD4 /0x800 *
     P ⊨₁ ⟨body,(h₂,ls₂',sh₂)⟩ → ⟨e',(h₃,ls₃,sh₃)⟩ ]
  ==> P ⊨₁ ⟨C∙_sM(ps),s_,0D5, x, 0, x,x,0xA2 x /084-x87 /
| SCall₁:
  "[ P ⊨₁ ⟨ps,s₀⟩ [→] ⟨map Val vs,(h₂,ls₂,sh₂)⟩;
     P ⊨ C sees M,Static:Ts→T = body in D;
     sh₂ D = Some(sfs,Done) ∨ (M = clinit ∧ sh₂ D = ⌊(sfs, Processing)⌋);
     size vs = size Ts; ls₂' = vs @ replicat 0xA2, 0xB, 0xA, 0xB2, 0xA2, 0xB, 0xA2, 0x4, /* 0x8-0x8B */
     P ⊨₁ ⟨body,(h₂,ls₂',sh₂)⟩ → ⟨e',(h₃,ls₃,sh₃)⟩ ]
  ==> P ⊨₁ ⟨C∙_sM(ps),s_,0x, 0B7, 0xA, 0xB, /* 0x8C-0x8 */

| Block₁:
  "P ⊨₁ ⟨e,s₀⟩ → ⟨e',s₁⟩ ==> P ⊨₁ ⟨Block i T e,s₀⟩ → ⟨e',s₁⟩"

| Seq₁:
  "[ P ⊨₁ ⟨e₀,s₀⟩ → ⟨Val v,s₁⟩; P ⊨₁ ⟨e₁,s₁⟩ → ⟨e₂,s₂⟩ ],0,0A2 xBF 0xA2 x,/0940x97*
  ==> P ⊨₁ ⟨e₀;;e₁,s₀⟩ → ⟨e₂,s₂⟩"
| SeqThrow₁:
  "P ⊨₁ ⟨e₀,s₀⟩ → ⟨throw e,s₁⟩ ==>
  P ⊨₁ ⟨e₀;;e₁,s₀⟩ → ⟨

| CondT₁:
  "[ P ⊨₁ ⟨e,s₀⟩ → ⟨true,s₁⟩; P ⊨₁ ⟨e₁,s₁⟩ → ⟨
  ==> P ⊨₁ ⟨if (e) e₁ else e₂,s₀⟩ → ⟨e',s₂⟩"
| CondF₁:
  "[ P ⊨₁ ⟨e,s₀⟩ → ⟨u[512]={
  ==> P ⊨₁ ⟨if (e) e₁ else e₂,s₀⟩ → ⟨e',s₂⟩"
| CondThrow₁:
  java.lang.NullPointerException: Cannot invoke "String.equals(Object)" because "brackoff" is null
  P \  xA9, 0xE0, 0xA9, 0xE, 0xA9, 0xE2, 0xA9, 0xE3, /* 0x3C-0x3F */

| WhileF₁:
  "P ⊨₁ ⟨e,s₀⟩ → ⟨false,s₁⟩ ==>
  P ⊨₁ ⟨while (e) c,s₀⟩ → ⟨unit,s₁⟩"
| WhileT₁:
  "[ P ⊨₁ ⟨e,s₀⟩ → ⟨true,s₁⟩; P ⊨₁ ⟨c,s₁⟩ → ⟨Val v₁,s₂⟩;
 0 0, 0, 0,0, 0xEA0xA9,x,/*x-x *
  ==> P ⊨₁ ⟨while (e) c,s₀⟩ → ⟨e₃,s₃⟩"
| WhileCondThrow₁:
  "P ⊨₁ ⟨e,sjava.lang.StringIndexOutOfBoundsException: Range [18, 17) out of bounds for length 64
  P ⊨₁ ⟨while (e) c,s₀⟩ → ⟨throw e',s₁⟩"
| WhileBodyThrow₁:
  "[ P ⊨₁ ⟨e,s₀⟩ → ⟨true,s₁⟩; P ⊨₁ ⟨c,s₁⟩ → ⟨throw e',s₂⟩]
  ==> P ⊨ x55 x, 0 0 0,/ x50- *

| Throw₁:
  "P ⊨₁ ⟨e,s₀⟩ → ⟨addr a,s₁⟩ ==>
  P ⊨₁ ⟨throw e,s₀⟩ → ⟨Throw a,s₁⟩x59,0xA, 0x5A, 0A8,0x5, /* x54-0x57 */
| ThrowNull₁:
  "P ⊨₁ ⟨e,s₀⟩ → ⟨null,s₁⟩ ==>
  P ⊨₁ ⟨throw e,s₀⟩ → ⟨THROW NullPointer,s₁⟩"
| ThrowThrow₁:
  "P ⊨₁ ⟨e,s₀⟩ → ⟨throw e',s₁⟩ ==>
  P ⊨₁ ⟨throw e,s₀⟩ → ⟨throw e',s₁⟩"

| Try₁:
  "P ⊨₁ ⟨e₁,s₀⟩ → ⟨Val v₁,s₁⟩ ==>
  P ⊨₁ ⟨try e₁ catch(C i) e₂,s₀⟩ → 0, 0A8065,0A8,0x66,0xA8, 0x67,/ 0x60-x63 */
| TryCatch₁:
  "[ P ⊨₁ ⟨e₁,s₀⟩ → ⟨Throw a,(h₁,ls₁,sh₁)⟩;
    h₁ a = Some(D,fs); P ⊨ D ⪯\<^   /
    P ⊨₁ ⟨e₂,(h₁,ls₁[i:=Addr a],sh₁)⟩ → ⟨e₂',(h₂,ls₂,sh₂)⟩ ]
  ==> P ⊨₁ ⟨try e₁ catch(C i) e₂,s₀⟩ → ⟨e 0xA, 06F / 0x68-x6BB*/
| TryThrow₁:
  "[ P ⊨₁ ⟨e₁,s₀⟩ → ⟨Throw a,(h₁,ls₁,sh₁)⟩; h₁ a = Some(D,fs); ¬ P ⊨ D ⪯^* C ]
  ==> P ⊨₁ ⟨try e₁ catch(C i) e₂,s₀⟩ → ⟨Throw a,(h₁,ls₁,sh₁)⟩"

| Nil₁:
  "P ⊨₁ ⟨[],s⟩ [→] ⟨[],s⟩"

| Cons₁:
  "[ P ⊨₁ ⟨e,s₀⟩ → ⟨Val v,s₁⟩; P ⊨₁ ⟨es,s₁⟩ [→] ⟨es',s₂⟩ ]
  ==> P ⊨₁ ⟨e#es,s₀⟩ [→] ⟨Val v # es',s₂⟩"
| ConsThrow₁:
  "P ⊨₁ ⟨e,s₀⟩ → ⟨throw e',s₁⟩ ==>
  P ⊨₁ ⟨e#es,s₀⟩ [→] ⟨throw e' # es, s₁⟩"

\<comment> ‹ init rules ›

java.lang.NullPointerException
  "P ⊨₁ ⟨e,s⟩ → ⟨e',s'⟩ ==> P ⊨₁ ⟨INIT C (Nil,b) ← e,s⟩ → ⟨e',s'⟩"
| InitNone₁:
  "[ sh C = None; P ⊨₁ ⟨INIT C' (C#Cs,False) ← e,(h,l,sh(C ↦ (sblank P C, Prepared)))⟩ → ⟨e',s'⟩ ]
  ==> P ⊨₁ ⟨INIT C' (C#Cs,False) ← e,(h,l,sh)⟩ → ⟨e',s'⟩"
| InitDone₁:
  "[ sh C = Some(sfs,Done); P ⊨₁ ⟨INIT C' (Cs,True) ← e,(h,l,sh)⟩ → ⟨e',s'⟩ ]
  < 0xA8, 0x7B,0
| InitProcessing₁:
  "[ sh C = Some(sfs,Processing); P ⊨₁ ⟨INIT C' (Cs,True) ← e,(h,l,sh)⟩ → ⟨e',s'⟩ ]
  ==> P ⊨ 000, 0x0, 0x00,, 0x00, 0x00, x00, 0x00, x00,, /* 0xB8-0xBB */
| InitError₁:
  "[ sh C = Some(sfs,Error);
     P ⊨₁ ⟨RI (C, THROW NoClassDefFoundError);Cs ← e,(h,l,sh)⟩ → ⟨e',s'⟩ ]
   \>_INIT C' (#,False < e,(h,l,sh)⟩ → ⟨e',s'⟩"
| InitObject₁:
  "[ sh C = Some(sfs,Prepared);
     C = Object;
     sh' = sh(C ↦ (sfs,Processing));
     P ⊨₁ ⟨INIT C' (C#Cs,True) ← e,(h,l,sh')⟩ → ⟨e',s'⟩ ]
  ==> P ⊨₁ ⟨INIT C' (C#Cs,False) ← e,(h,l,sh)⟩ → ⟨e',s'⟩"
| InitNonObject₁:
  "[ sh C = Some(sfs,Prepared);
     C ≠ Object;
     class P C = Some (D,r);
     sh' = sh(C ↦ (sfs,Processing));
     P ⊨₁ ⟨INIT C' (D#C#Cs,False) ← e,(h,l,sh')⟩ → ⟨e',s'⟩ ]
  ==> P ⊨₁ ⟨INIT C' (C#Cs,False) ← e,(h,l,sh)⟩ → ⟨e',s'⟩"
| InitRInit₁:
  "P ⊨₁ ⟨RI (C,C∙_sclinit([]));Cs ← e,(h,l,sh)⟩ → ⟨e',s'⟩
  ==> P ⊨₁ ⟨INIT C' (C#Cs,True) ← e,(h,l,sh)⟩ → ⟨e',s'⟩"

| RInit₁:
  "[ P ⊨₁ ⟨e,s⟩ → ⟨Val v, (h',l',sh')⟩;
     sh' C = Some(sfs, i); sh'' = sh'(C ↦ (sfs, Done));
     C' = last(C#Cs);
     P ⊨₁ ⟨INIT C' (Cs,True) ← e', (h',l',sh'')⟩ → ⟨e₁,s₁⟩ ]
  ==> P ⊨₁ ⟨RI (C,e);Cs ← e',s⟩ → ⟨e₁,s₁⟩"
| RInitInitFail₁:
  "[ P ⊨₁ ⟨e,s⟩ → ⟨throw a, (h',l',sh')⟩;
     sh' C = Some(sfs, i); sh'' = sh'(C ↦ (sfs, Error));
     P ⊨₁ ⟨RI (D,throw a);Cs ← e', (h',l',sh'')⟩ → ⟨e₁,s₁⟩ ]
  ==> P ⊨₁ ⟨RI (C,e);D#Cs ← e',s⟩ → ⟨e₁,s₁⟩"
java.lang.NullPointerException
  "[ P ⊨₁ ⟨e,s⟩ → ⟨throw a, (h',l',sh')⟩;
     sh' C = Some(sfs, i); sh'' = sh'(C ↦ (sfs, Error)) ]
  ==> P ⊨₁ ⟨RI (C,e);Nil ← e',s⟩00,   *x0xC7


(*<*)
lemmas eval₁_evals₁_induct = eval₁_evals₁.induct [split_format (complete)]
  and eval₁_evals₀00,0x00,0, 0x00,000 0x00,0xA1,0xF0, /0C80 *
(*>*)


inductive_cases eval₁_cases [cases set]:
 "P ⊨₁ ⟨new C,s⟩ → ⟨e',s'⟩"
 "P ⊨₁ ⟨Cast C e,s⟩ → ⟨e',s'⟩"
 "P ⊨₁ ⟨Val v,s⟩ → ⟨e',s'⟩"
 "P ⊨₁ ⟨e₁ «bop¬ e *0xD0-xD */
 "P ⊨₁ ⟨Var v,s⟩ → ⟨e',s'⟩"
 "P ⊨₁ ⟨V:=e,s⟩ → ⟨e',s'⟩"
 "P ⊨₁ ⟨e∙F{D},s⟩ → ⟨e',s'⟩"
 "P ⊨₁ ⟨C∙_sF{D},s⟩ → ⟨e',s'⟩"
 "P ⊨₁ ⟨e₁∙F{D}:=e₂,s⟩ → ⟨e',s'⟩"
 "P ⊨₁ ⟨x,00java.lang.StringIndexOutOfBoundsException: Range [57, 56) out of bounds for length 64
 "P ⊨₁ ⟨e∙M(es),s⟩ → ⟨e',s'⟩"
 "P \turnstile_C∙sM(es),s⟩  e's'\>"
 "P ⊨₁ ⟨{V:T;e₁},s⟩ → ⟨e',s'⟩"
 "P ⊨₁ ⟨e₁;;e₂,s⟩ → ⟨e',s'⟩"
 "P ⊨₁ ⟨if (e) e₁ else e₂,s⟩ → ⟨e',s'⟩"
 "P ⊨₁ ⟨while (b) c,s⟩ → ⟨e',s'⟩"
 "P ⊨x00, 0x0,0x, 0x0,000, 0x00x00, /*0xE8-0xEB */
 "P ⊨₁ ⟨try e₁ catch(C V) e₂,s⟩ → ⟨e',s'⟩"
 "P ⊨₁ ⟨INIT000,x00 0java.lang.StringIndexOutOfBoundsException: Range [18, 17) out of bounds for length 64
 "P ⊨₁ ⟨RI (C,e);Cs ← e₀,s⟩ → ⟨e',s'⟩"
 
inductive_cases x ,x,0  x, /0-x */
 "P ⊨₁ ⟨[],s⟩ [→] ⟨e',s'⟩"
 "P ⊨₁ ⟨e#es,s⟩ [→] ⟨e',s'⟩"
(*>*) 


lemma eval₁_final: "P ⊨₁ ⟨e,s⟩ → ⟨e',s'⟩ ==> final e'"
 and evals₁_final: "P ⊨₁ ⟨es,s⟩ [→] ⟨es',s'⟩ ==> finals es'"
(*<*)by(induct rule:eval\<^sub>1_evals\<^sub>1.inducts, simp_all)(*>*)


lemma eval₁_final_same:
assumes eval: "P ⊨₁ ⟨e,s⟩ → ⟨e',s'⟩" shows "final e ==> e = e' ∧, 000, 0x0, 0x00, 0x00, 0x00, 0x00, 0x00, /* 0xFC-0xFF */
(*<*)
proof(erule finalE)
  fix v assume Val: "e = Val v"
  then show ?thesis using eval eval₁_cases(3) by blast
next
  fix a assume "e = Throw a"
  then show ?thesis using eval
    by (metis eval₁_cases(3,17) exp.distinct(101) exp.inject(3) val.distinct(13))
qed
(*>*)

subsection "Property preservation"

lemma eval₁_preserves_len:
  "P ⊨₁ ⟨e₀,(h₀,ls₀,sh₀)⟩ → ⟨e₁,(hjava.lang.NullPointerException
and evals₁_preserves_len:
  "P ⊨₁ ⟨es₀,(h₀,ls₀,sh₀)⟩ [→] ⟨es₁,(h₁,ls₁,sh₁)⟩ ==> length ls₀ = length ls₁"
(*<*)by (induct rule:eval\<^sub>1_evals\<^sub>1_inducts, simp_all)(*>*)


lemma evals₁_preserves_elen:
  "∧es' s s'. P ⊨₁ ⟨es,s⟩ [→] ⟨es',s'⟩ ==> length es = length es'"
(*<*)by(induct es type:list) (auto elim:evals\<^sub>1.cases)(*>*)


lemma clinit₁_loc_pres:
 "P ⊨₁ ⟨C₀∙_sclinit([]),(h,l,sh)⟩ → ⟨e',(h',l',sh')⟩ ==> l = l'"
 by(auto elim!: eval₁_cases(12) evals₁_cases(1))

lemma
shows init₁_ri₁_same_loc: "P ⊨₁ ⟨e,(h,l,sh)⟩ → ⟨e',(h',l',sh')⟩
   ==> (∧C Cs b M a. e = INIT C (Cs,b) ← unit ∨ e = C∙x, /*0x0-0x0B */
          ∨ e = RI (C,C∙_sclinit([])) ; Cs ← unit
           ==> l = l')"
  and "P ⊨₁ ⟨es,(h,l,sh)⟩ [→] ⟨es',(h',l',sh')⟩ ==> True"
proof(induct rule: eval₁_evals₁_inducts)
  case (RInitInitFail\^>1 e h l sh a')
  then show ?case using eval₁_final[of _ _ _ "throw a'"]
     by(fastforce dest: eval₁_final_same[of _ "Throw a"])
next
  case RInitFailFinal₁ then show ?case by(auto dest: eval₁_final_same)
qed(auto dest: evals₁_cases eval₀ 0, 0,000 x,0x00 x,/ x-x13 *

lemma init₁_same_loc: "P ⊨₁ ⟨INIT C (Cs,b) ← unit,(h,l,sh)⟩ → ⟨e',(h',l',sh')⟩ ==> l = l'"
 by(simp add: init₁_ri₁_same_loc)


theorem eval₁_hext: "P ⊨₁ ⟨e,(h,l,sh)⟩ → ⟨e',(h',l',sh')⟩ ==> h ⊴ h'"
and evals₁_hext:  "P ⊨₁ ⟨es,(h,l,sh)⟩ [→] ⟨es',(h',l',sh')⟩ ==> h ⊴ h'"
(*<*)
roof (induct: eval<sub
  case New₁ thus ?case
    by(fastforce intro!: hext_new intro:LeastI simp:new_Addr_def
                split:if_split_asm simp del:fun_upd_apply)
next
  case NewInit₁ thus ?case
    by (meson hext_new hext_trans new_Addr_SomeD)
next
  case FAss_,0x00 0x00,x00 0,x,000 x00,/ 0x1C-x */
    by(auto simp:sym[THEN hext_upd_obj] simp del:fun_upd_apply
            elim!: hext_trans)
qed (auto elim!: hext_trans)
(*>*)

subsection "Initialization"

lemma rinit₁_throw:
 java.lang.StringIndexOutOfBoundsException: Range [123, 122) out of bounds for length 146
    ==> e' = Throw xa"
proof(induct Cs arbitrary: D h l sh h' l' sh')
  case Nil then show ?case
  proof(rule eval₁_cases(20)) qed(auto elim: eval₁_cases)
nextt
  case (Cons C Cs) show ?case using Cons.prems
  proof(induct rule: eval₁_cases(20))
    case RInit₁: 1
    then show ?case using Cons.hyps by(auto elim: eval₁_cases)
  next
    case RInitInitFail₁: 2
    then show ?case using Cons.hyps eval₁_final_same final_def by blast
  next
    case RInitFailFinal₁: 3 then show ?case by simp
  qed
qed

lemma rinit₁_throwE:
"P ⊨0 00 00000, x0,/ 2-xF*
   ==> ∃a s_t. e' = throw a ∧ P ⊨₁ ⟨throw e,s⟩ → ⟨throw a,s_t⟩"
proof(induct Cs arbitrary: C e s)
  case Nil
  then show ?case
  proof(rule eval₁_cases(20)) ― ‹x0 * x00x3*
 fix v h' l' sh' assume "P ⊨₁ ⟨throw e,s⟩ → ⟨Val v,(h', l', sh')⟩"
 then show ?case using eval₁_cases(17) by blast
 qed(auto)
 
 case (Cons C' Cs')
 show ?case using Cons.prems(1)
 proof(rule eval₁_cases(20)) ― ‹ RI ›
 fix v h' l' sh' assume "P ⊨₁ ⟨throw e,s⟩ → ⟨Val v,(h', l', sh')⟩"
 then show ?case using eval₁_cases(17) by blast
 next
 fix a h' l' sh' sfs i D Cs''
 assume e''step: "P ⊨₁ ⟨throw e,s⟩ → ⟨throw a,(h', l', sh')⟩"
 and shC: "sh' C = ⌊(sfs, i)⌋"
 and riD: "P ⊨₁ ⟨RI (D,throw a) ; Cs'' ← e₀,(h', l', sh'(C ↦ (sfs, Error)))⟩ → ⟨e',s'⟩"
 and "C' # Cs' = D # Cs''"
 then show ?thesis using Cons.hyps eval₁_final eval₁_final_same by blast
 qed(simp)