@@ -187,6 +187,7 @@ We want K to understand what a bit-shift is.
187187
188188 rule (X >>Int N) => 0
189189 requires 0 <=Int N
190+ andBool 0 <=Int X
190191 andBool X <Int 2 ^Int N
191192 [simplification]
192193 rule (_X <<Int N) modInt M => 0
@@ -212,9 +213,11 @@ We want K to understand what a bit-shift is.
212213``` k
213214 rule ((X <<Int M) +Int Y) >>Int N => (X <<Int (M -Int N)) +Int (Y >>Int N)
214215 requires M >=Int N andBool N >=Int 0
216+ andBool 0 <=Int X andBool 0 <=Int Y
215217 [simplification]
216218 rule (Y +Int (X <<Int M)) >>Int N => (X <<Int (M -Int N)) +Int (Y >>Int N)
217219 requires M >=Int N andBool N >=Int 0
220+ andBool 0 <=Int X andBool 0 <=Int Y
218221 [simplification]
219222```
220223
@@ -241,6 +244,7 @@ The following rules decrease the modulus by rearranging it around a shift.
241244 requires N >=Int 0
242245 andBool POW >Int 0
243246 andBool POW modInt (2 ^Int N) ==Int 0
247+ andBool 0 <=Int X
244248 [simplification]
245249
246250 rule (X <<Int N) modInt POW => (X modInt (POW /Int (2 ^Int N))) <<Int N
@@ -310,8 +314,9 @@ Bounds on `#getRange`:
310314 rule 0 <=Int VAL1 +Int VAL2 => true requires 0 <=Int VAL1 andBool 0 <=Int VAL2 [simplification]
311315
312316 rule #getRange(_, _, WIDTH) <Int MAX => true requires 2 ^Int (8 *Int WIDTH) <=Int MAX [simplification]
313- rule #getRange(_, _, WIDTH) <<Int SHIFT <Int MAX => true requires 2 ^Int ((8 *Int WIDTH) +Int SHIFT) <=Int MAX
314- requires 0 <=Int SHIFT
317+ rule #getRange(_, _, WIDTH) <<Int SHIFT <Int MAX => true
318+ requires 2 ^Int ((8 *Int WIDTH) +Int SHIFT) <=Int MAX
319+ andBool 0 <=Int SHIFT
315320 [simplification]
316321 rule (#getRange(_, _, WIDTH1) #as VAL1) +Int ((#getRange(_, _, WIDTH2) <<Int SHIFT) #as VAL2) <Int MAX => true
317322 requires VAL1 <Int MAX
0 commit comments