diff --git a/thys/Jinja/Compiler/Correctness1.thy b/thys/Jinja/Compiler/Correctness1.thy
--- a/thys/Jinja/Compiler/Correctness1.thy
+++ b/thys/Jinja/Compiler/Correctness1.thy
@@ -1,760 +1,761 @@
 (*  Title:      Jinja/Compiler/Correctness1.thy
     Author:     Tobias Nipkow
     Copyright   TUM 2003
 *)
 
 section \<open>Correctness of Stage 1\<close>
 
 theory Correctness1
 imports J1WellForm Compiler1
 begin
 
 subsection\<open>Correctness of program compilation\<close>
 
 primrec unmod :: "expr\<^sub>1 \<Rightarrow> nat \<Rightarrow> bool"
   and unmods :: "expr\<^sub>1 list \<Rightarrow> nat \<Rightarrow> bool" where
 "unmod (new C) i = True" |
 "unmod (Cast C e) i = unmod e i" |
 "unmod (Val v) i = True" |
 "unmod (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2) i = (unmod e\<^sub>1 i \<and> unmod e\<^sub>2 i)" |
 "unmod (Var i) j = True" |
 "unmod (i:=e) j = (i \<noteq> j \<and> unmod e j)" |
 "unmod (e\<bullet>F{D}) i = unmod e i" |
 "unmod (e\<^sub>1\<bullet>F{D}:=e\<^sub>2) i = (unmod e\<^sub>1 i \<and> unmod e\<^sub>2 i)" |
 "unmod (e\<bullet>M(es)) i = (unmod e i \<and> unmods es i)" |
 "unmod {j:T; e} i = unmod e i" |
 "unmod (e\<^sub>1;;e\<^sub>2) i = (unmod e\<^sub>1 i \<and>  unmod e\<^sub>2 i)" |
 "unmod (if (e) e\<^sub>1 else e\<^sub>2) i = (unmod e i \<and> unmod e\<^sub>1 i \<and> unmod e\<^sub>2 i)" |
 "unmod (while (e) c) i = (unmod e i \<and> unmod c i)" |
 "unmod (throw e) i = unmod e i" |
 "unmod (try e\<^sub>1 catch(C i) e\<^sub>2) j = (unmod e\<^sub>1 j \<and> (if i=j then False else unmod e\<^sub>2 j))" |
 
 "unmods ([]) i = True" |
 "unmods (e#es) i = (unmod e i \<and> unmods es i)"
 
 lemma hidden_unmod: "\<And>Vs. hidden Vs i \<Longrightarrow> unmod (compE\<^sub>1 Vs e) i" and
  "\<And>Vs. hidden Vs i \<Longrightarrow> unmods (compEs\<^sub>1 Vs es) i"
 (*<*)
-apply(induct e and es rule: compE\<^sub>1.induct compEs\<^sub>1.induct)
-apply (simp_all add:hidden_inacc)
-apply(auto simp add:hidden_def)
-done
+proof(induct e and es rule: compE\<^sub>1.induct compEs\<^sub>1.induct)
+  case TryCatch
+  then show ?case by(simp add:hidden_inacc)(auto simp add:hidden_def)
+qed (simp_all add:hidden_inacc)
 (*>*)
 
 
 lemma eval\<^sub>1_preserves_unmod:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,(h,ls)\<rangle> \<Rightarrow> \<langle>e',(h',ls')\<rangle>; unmod e i; i < size ls \<rbrakk>
   \<Longrightarrow> ls ! i = ls' ! i"
 and "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>es,(h,ls)\<rangle> [\<Rightarrow>] \<langle>es',(h',ls')\<rangle>; unmods es i; i < size ls \<rbrakk>
       \<Longrightarrow> ls ! i = ls' ! i"
 (*<*)
-apply(induct rule:eval\<^sub>1_evals\<^sub>1_inducts)
-apply(auto dest!:eval\<^sub>1_preserves_len split:if_split_asm)
-done
+proof(induct rule:eval\<^sub>1_evals\<^sub>1_inducts)
+qed(auto dest!:eval\<^sub>1_preserves_len evals\<^sub>1_preserves_len split:if_split_asm)
 (*>*)
 
 
 lemma LAss_lem:
   "\<lbrakk>x \<in> set xs; size xs \<le> size ys \<rbrakk>
   \<Longrightarrow> m\<^sub>1 \<subseteq>\<^sub>m m\<^sub>2(xs[\<mapsto>]ys) \<Longrightarrow> m\<^sub>1(x\<mapsto>y) \<subseteq>\<^sub>m m\<^sub>2(xs[\<mapsto>]ys[last_index xs x := y])"
 (*<*)
 by(simp add:map_le_def fun_upds_apply eq_sym_conv)
 (*>*)
 lemma Block_lem:
 fixes l :: "'a \<rightharpoonup> 'b"
 assumes 0: "l \<subseteq>\<^sub>m [Vs [\<mapsto>] ls]"
     and 1: "l' \<subseteq>\<^sub>m [Vs [\<mapsto>] ls', V\<mapsto>v]"
     and hidden: "V \<in> set Vs \<Longrightarrow> ls ! last_index Vs V = ls' ! last_index Vs V"
     and size: "size ls = size ls'"    "size Vs < size ls'"
 shows "l'(V := l V) \<subseteq>\<^sub>m [Vs [\<mapsto>] ls']"
 (*<*)
 proof -
   have "l'(V := l V) \<subseteq>\<^sub>m [Vs [\<mapsto>] ls', V\<mapsto>v](V := l V)"
     using 1 by(rule map_le_upd)
   also have "\<dots> = [Vs [\<mapsto>] ls'](V := l V)" by simp
   also have "\<dots> \<subseteq>\<^sub>m [Vs [\<mapsto>] ls']"
   proof (cases "l V")
     case None thus ?thesis by simp
   next
     case (Some w)
     hence "[Vs [\<mapsto>] ls] V = Some w"
       using 0 by(force simp add: map_le_def split:if_splits)
     hence VinVs: "V \<in> set Vs" and w: "w = ls ! last_index Vs V"
       using size by(auto simp add:fun_upds_apply split:if_splits)
     hence "w = ls' ! last_index Vs V" using hidden[OF VinVs] by simp
     hence "[Vs [\<mapsto>] ls'](V := l V) = [Vs [\<mapsto>] ls']" using Some size VinVs
       by(simp add: map_upds_upd_conv_last_index)
     thus ?thesis by simp
   qed
   finally show ?thesis .
 qed
 (*>*)
 
 (*<*)
 declare fun_upd_apply[simp del]
 (*>*)
 
 
 text\<open>\noindent The main theorem:\<close>
 
 theorem assumes wf: "wwf_J_prog P"
 shows eval\<^sub>1_eval: "P \<turnstile> \<langle>e,(h,l)\<rangle> \<Rightarrow> \<langle>e',(h',l')\<rangle>
   \<Longrightarrow> (\<And>Vs ls. \<lbrakk> fv e \<subseteq> set Vs;  l \<subseteq>\<^sub>m [Vs[\<mapsto>]ls]; size Vs + max_vars e \<le> size ls \<rbrakk>
        \<Longrightarrow> \<exists>ls'. compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs e,(h,ls)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h',ls')\<rangle> \<and> l' \<subseteq>\<^sub>m [Vs[\<mapsto>]ls'])"
 (*<*)
   (is "_ \<Longrightarrow> (\<And>Vs ls. PROP ?P e h l e' h' l' Vs ls)"
    is "_ \<Longrightarrow> (\<And>Vs ls. \<lbrakk> _; _; _ \<rbrakk> \<Longrightarrow> \<exists>ls'. ?Post e h l e' h' l' Vs ls ls')")
 (*>*)
 
 and evals\<^sub>1_evals: "P \<turnstile> \<langle>es,(h,l)\<rangle> [\<Rightarrow>] \<langle>es',(h',l')\<rangle>
     \<Longrightarrow> (\<And>Vs ls. \<lbrakk> fvs es \<subseteq> set Vs;  l \<subseteq>\<^sub>m [Vs[\<mapsto>]ls]; size Vs + max_varss es \<le> size ls \<rbrakk>
          \<Longrightarrow> \<exists>ls'. compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compEs\<^sub>1 Vs es,(h,ls)\<rangle> [\<Rightarrow>] \<langle>compEs\<^sub>1 Vs es',(h',ls')\<rangle> \<and>
                       l' \<subseteq>\<^sub>m [Vs[\<mapsto>]ls'])"
 (*<*)
   (is "_ \<Longrightarrow> (\<And>Vs ls. PROP ?Ps es h l es' h' l' Vs ls)"
    is "_ \<Longrightarrow> (\<And>Vs ls. \<lbrakk> _; _; _\<rbrakk> \<Longrightarrow> \<exists>ls'. ?Posts es h l es' h' l' Vs ls ls')")
 proof (induct rule:eval_evals_inducts)
   case Nil thus ?case by(fastforce intro!:Nil\<^sub>1)
 next
   case (Cons e h l v h' l' es es' h\<^sub>2 l\<^sub>2)
   have "PROP ?P e h l (Val v) h' l' Vs ls" by fact
   with Cons.prems
   obtain ls' where 1: "?Post e h l (Val v) h' l' Vs ls ls'"
     "size ls = size ls'" by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?Ps es h' l' es' h\<^sub>2 l\<^sub>2 Vs ls'" by fact
   with 1 Cons.prems
   obtain ls\<^sub>2 where 2: "?Posts es h' l' es' h\<^sub>2 l\<^sub>2 Vs ls' ls\<^sub>2" by(auto)
   from 1 2 Cons show ?case by(auto intro!:Cons\<^sub>1)
 next
   case ConsThrow thus ?case
     by(fastforce intro!:ConsThrow\<^sub>1 dest: eval_final)
 next
   case (Block e h l V e' h' l' T)
   let ?Vs = "Vs @ [V]"
   have IH:
   "\<lbrakk>fv e \<subseteq> set ?Vs; l(V := None) \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls];
     size ?Vs + max_vars e \<le> size ls\<rbrakk>
    \<Longrightarrow> \<exists>ls'. compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 ?Vs e,(h,ls)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h', ls')\<rangle> \<and>
              l' \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls']" and
   fv: "fv {V:T; e} \<subseteq> set Vs" and rel: "l \<subseteq>\<^sub>m [Vs [\<mapsto>] ls]" and
   len: "length Vs + max_vars {V:T; e} \<le> length ls" by fact+
   have len': "length Vs < length ls" using len by auto
   have "fv e \<subseteq> set ?Vs" using fv by auto
   moreover have "l(V := None) \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls]" using rel len' by simp
   moreover have "size ?Vs + max_vars e \<le> size ls" using len by simp
   ultimately obtain ls' where
    1: "compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 ?Vs e,(h,ls)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h',ls')\<rangle>"
    and rel': "l' \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls']" using IH by blast
   have [simp]: "length ls = length ls'" by(rule eval\<^sub>1_preserves_len[OF 1])
   show "\<exists>ls'. compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs {V:T; e},(h,ls)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h',ls')\<rangle>
               \<and> l'(V := l V) \<subseteq>\<^sub>m [Vs [\<mapsto>] ls']" (is "\<exists>ls'. ?R ls'")
   proof
     show "?R ls'"
     proof
       show "compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs {V:T; e},(h,ls)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h',ls')\<rangle>"
         using 1 by(simp add:Block\<^sub>1)
     next
       show "l'(V := l V) \<subseteq>\<^sub>m [Vs [\<mapsto>] ls']"
       proof -
         have "l' \<subseteq>\<^sub>m [Vs [\<mapsto>] ls', V \<mapsto> ls' ! length Vs]"
           using len' rel' by simp
         moreover
         { assume VinVs: "V \<in> set Vs"
           hence "hidden (Vs @ [V]) (last_index Vs V)"
             by(rule hidden_last_index)
           hence "unmod (compE\<^sub>1 (Vs @ [V]) e) (last_index Vs V)"
             by(rule hidden_unmod)
           moreover have "last_index Vs V < length ls"
             using len' VinVs by simp
           ultimately have "ls ! last_index Vs V = ls' ! last_index Vs V"
             by(rule eval\<^sub>1_preserves_unmod[OF 1])
         }
         ultimately show ?thesis using Block_lem[OF rel] len' by auto
       qed
     qed
   qed
 next
   case (TryThrow e' h l a h' l' D fs C V e\<^sub>2)
   have "PROP ?P e' h l (Throw a) h' l' Vs ls" by fact
   with TryThrow.prems
   obtain ls' where 1: "?Post e' h l (Throw a) h' l' Vs ls ls'"  by(auto)
   show ?case using 1 TryThrow.hyps by(auto intro!:eval\<^sub>1_evals\<^sub>1.TryThrow\<^sub>1)
 next
   case (TryCatch e\<^sub>1 h l a h\<^sub>1 l\<^sub>1 D fs C e\<^sub>2 V e' h\<^sub>2 l\<^sub>2)
   let ?e = "try e\<^sub>1 catch(C V) e\<^sub>2"
   have IH\<^sub>1: "\<lbrakk>fv e\<^sub>1 \<subseteq> set Vs; l \<subseteq>\<^sub>m [Vs [\<mapsto>] ls];
               size Vs + max_vars e\<^sub>1 \<le> length ls\<rbrakk>
           \<Longrightarrow> \<exists>ls\<^sub>1. compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs e\<^sub>1,(h,ls)\<rangle> \<Rightarrow>
                                 \<langle>fin\<^sub>1 (Throw a),(h\<^sub>1,ls\<^sub>1)\<rangle> \<and>
                     l\<^sub>1 \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>1]" and
     fv: "fv ?e \<subseteq> set Vs" and
     rel: "l \<subseteq>\<^sub>m [Vs [\<mapsto>] ls]" and
     len: "length Vs + max_vars ?e \<le> length ls" by fact+
   have "fv e\<^sub>1 \<subseteq> set Vs" using fv by auto
   moreover have "length Vs + max_vars e\<^sub>1 \<le> length ls" using len by(auto)
   ultimately obtain ls\<^sub>1 where
     1: "compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs e\<^sub>1,(h,ls)\<rangle> \<Rightarrow> \<langle>Throw a,(h\<^sub>1,ls\<^sub>1)\<rangle>"
     and rel\<^sub>1: "l\<^sub>1 \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>1]" using IH\<^sub>1 rel by fastforce
   from 1 have [simp]: "size ls = size ls\<^sub>1" by(rule eval\<^sub>1_preserves_len)
   let ?Vs = "Vs @ [V]" let ?ls = "(ls\<^sub>1[size Vs:=Addr a])"
   have IH\<^sub>2: "\<lbrakk>fv e\<^sub>2 \<subseteq> set ?Vs; l\<^sub>1(V \<mapsto> Addr a) \<subseteq>\<^sub>m [?Vs [\<mapsto>] ?ls];
               length ?Vs + max_vars e\<^sub>2 \<le> length ?ls\<rbrakk> \<Longrightarrow> \<exists>ls\<^sub>2.
        compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 ?Vs e\<^sub>2,(h\<^sub>1,?ls)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h\<^sub>2, ls\<^sub>2)\<rangle> \<and>
        l\<^sub>2 \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls\<^sub>2]" by fact
   have len\<^sub>1: "size Vs < size ls\<^sub>1" using len by(auto)
   have "fv e\<^sub>2 \<subseteq> set ?Vs" using fv by auto
   moreover have "l\<^sub>1(V \<mapsto> Addr a) \<subseteq>\<^sub>m [?Vs [\<mapsto>] ?ls]" using rel\<^sub>1 len\<^sub>1 by simp
   moreover have "length ?Vs + max_vars e\<^sub>2 \<le> length ?ls" using len by(auto)
   ultimately obtain ls\<^sub>2 where
     2: "compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 ?Vs e\<^sub>2,(h\<^sub>1,?ls)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h\<^sub>2, ls\<^sub>2)\<rangle>"
     and rel\<^sub>2: "l\<^sub>2 \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls\<^sub>2]"  using IH\<^sub>2 by blast
   from 2 have [simp]: "size ls\<^sub>1 = size ls\<^sub>2"
     by(fastforce dest: eval\<^sub>1_preserves_len)
   show "\<exists>ls\<^sub>2. compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs ?e,(h,ls)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h\<^sub>2,ls\<^sub>2)\<rangle> \<and>
               l\<^sub>2(V := l\<^sub>1 V) \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>2]"  (is "\<exists>ls\<^sub>2. ?R ls\<^sub>2")
   proof
     show "?R ls\<^sub>2"
     proof
       have hp: "h\<^sub>1 a = Some (D, fs)" by fact
       have "P \<turnstile> D \<preceq>\<^sup>* C" by fact hence caught: "compP\<^sub>1 P \<turnstile> D \<preceq>\<^sup>* C" by simp
       from TryCatch\<^sub>1[OF 1 _ caught len\<^sub>1 2, OF hp]
       show "compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs ?e,(h,ls)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h\<^sub>2,ls\<^sub>2)\<rangle>" by simp
     next
       show "l\<^sub>2(V := l\<^sub>1 V) \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>2]"
       proof -
         have "l\<^sub>2 \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>2, V \<mapsto> ls\<^sub>2 ! length Vs]"
           using len\<^sub>1 rel\<^sub>2 by simp
         moreover
         { assume VinVs: "V \<in> set Vs"
           hence "hidden (Vs @ [V]) (last_index Vs V)" by(rule hidden_last_index)
           hence "unmod (compE\<^sub>1 (Vs @ [V]) e\<^sub>2) (last_index Vs V)"
             by(rule hidden_unmod)
           moreover have "last_index Vs V < length ?ls"
             using len\<^sub>1 VinVs by simp
           ultimately have "?ls ! last_index Vs V = ls\<^sub>2 ! last_index Vs V"
             by(rule eval\<^sub>1_preserves_unmod[OF 2])
           moreover have "last_index Vs V < size Vs" using VinVs by simp
           ultimately have "ls\<^sub>1 ! last_index Vs V = ls\<^sub>2 ! last_index Vs V"
             using len\<^sub>1 by(simp del:size_last_index_conv)
         }
         ultimately show ?thesis using Block_lem[OF rel\<^sub>1] len\<^sub>1  by simp
       qed
     qed
   qed
 next
   case Try thus ?case by(fastforce intro!:Try\<^sub>1)
 next
   case Throw thus ?case by(fastforce intro!:Throw\<^sub>1)
 next
   case ThrowNull thus ?case by(fastforce intro!:ThrowNull\<^sub>1)
 next
   case ThrowThrow thus ?case  by(fastforce intro!:ThrowThrow\<^sub>1)
 next
   case (CondT e h l h\<^sub>1 l\<^sub>1 e\<^sub>1 e' h\<^sub>2 l\<^sub>2 e\<^sub>2)
   have "PROP ?P e h l true h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with CondT.prems
   obtain ls\<^sub>1 where 1: "?Post e h l true h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"  by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>1 h\<^sub>1 l\<^sub>1 e' h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 CondT.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>1 h\<^sub>1 l\<^sub>1 e' h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 show ?case by(auto intro!:CondT\<^sub>1)
 next
   case (CondF e h l h\<^sub>1 l\<^sub>1 e\<^sub>2 e' h\<^sub>2 l\<^sub>2 e\<^sub>1 Vs ls)
   have "PROP ?P e h l false h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with CondF.prems
   obtain ls\<^sub>1 where 1: "?Post e h l false h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"  by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>2 h\<^sub>1 l\<^sub>1 e' h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 CondF.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>2 h\<^sub>1 l\<^sub>1 e' h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 show ?case by(auto intro!:CondF\<^sub>1)
 next
   case CondThrow thus ?case by(fastforce intro!:CondThrow\<^sub>1)
 next
   case (Seq e h l v h\<^sub>1 l\<^sub>1 e\<^sub>1 e' h\<^sub>2 l\<^sub>2)
   have "PROP ?P e h l (Val v) h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with Seq.prems
   obtain ls\<^sub>1 where 1: "?Post e h l (Val v) h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"  by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>1 h\<^sub>1 l\<^sub>1 e' h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 Seq.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>1 h\<^sub>1 l\<^sub>1 e' h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 Seq show ?case by(auto intro!:Seq\<^sub>1)
 next
   case SeqThrow thus ?case by(fastforce intro!:SeqThrow\<^sub>1)
 next
   case WhileF thus ?case by(fastforce intro!:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (WhileT e h l h\<^sub>1 l\<^sub>1 c v h\<^sub>2 l\<^sub>2 e' h\<^sub>3 l\<^sub>3)
   have "PROP ?P e h l true h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with WhileT.prems
   obtain ls\<^sub>1 where 1: "?Post e h l true h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"   by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P c h\<^sub>1 l\<^sub>1 (Val v) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 WhileT.prems
   obtain ls\<^sub>2 where 2: "?Post c h\<^sub>1 l\<^sub>1 (Val v) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"
     "size ls\<^sub>1 = size ls\<^sub>2"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P (While (e) c) h\<^sub>2 l\<^sub>2 e' h\<^sub>3 l\<^sub>3 Vs ls\<^sub>2" by fact
   with 1 2 WhileT.prems
   obtain ls\<^sub>3 where 3: "?Post (While (e) c) h\<^sub>2 l\<^sub>2 e' h\<^sub>3 l\<^sub>3 Vs ls\<^sub>2 ls\<^sub>3" by(auto)
   from 1 2 3 show ?case by(auto intro!:WhileT\<^sub>1)
 next
   case (WhileBodyThrow e h l h\<^sub>1 l\<^sub>1 c e' h\<^sub>2 l\<^sub>2)
   have "PROP ?P e h l true h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with WhileBodyThrow.prems
   obtain ls\<^sub>1 where 1: "?Post e h l true h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P c h\<^sub>1 l\<^sub>1 (throw e') h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 WhileBodyThrow.prems
   obtain ls\<^sub>2 where 2: "?Post c h\<^sub>1 l\<^sub>1 (throw e') h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2" by auto
   from 1 2 show ?case by(auto intro!:WhileBodyThrow\<^sub>1)
 next
   case WhileCondThrow thus ?case by(fastforce intro!:WhileCondThrow\<^sub>1)
 next
   case New thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case NewFail thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case Cast thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case CastNull thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case CastThrow thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (CastFail e h l a h\<^sub>1 l\<^sub>1 D fs C)
   have "PROP ?P e h l (addr a) h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with CastFail.prems
   obtain ls\<^sub>1 where 1: "?Post e h l (addr a) h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1" by auto
   show ?case using 1 CastFail.hyps
     by(auto intro!:CastFail\<^sub>1[where D=D])
 next
   case Val thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (BinOp e h l v\<^sub>1 h\<^sub>1 l\<^sub>1 e\<^sub>1 v\<^sub>2 h\<^sub>2 l\<^sub>2 bop v)
   have "PROP ?P e h l (Val v\<^sub>1) h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with BinOp.prems
   obtain ls\<^sub>1 where 1: "?Post e h l (Val v\<^sub>1) h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>1 h\<^sub>1 l\<^sub>1 (Val v\<^sub>2) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 BinOp.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>1 h\<^sub>1 l\<^sub>1 (Val v\<^sub>2) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 BinOp show ?case by(auto intro!:BinOp\<^sub>1)
 next
   case (BinOpThrow2 e\<^sub>0 h l v\<^sub>1 h\<^sub>1 l\<^sub>1 e\<^sub>1 e h\<^sub>2 l\<^sub>2 bop)
   have "PROP ?P e\<^sub>0 h l (Val v\<^sub>1) h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with BinOpThrow2.prems
   obtain ls\<^sub>1 where 1: "?Post e\<^sub>0 h l (Val v\<^sub>1) h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>1 h\<^sub>1 l\<^sub>1 (throw e) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 BinOpThrow2.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>1 h\<^sub>1 l\<^sub>1 (throw e) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 BinOpThrow2 show ?case by(auto intro!:BinOpThrow\<^sub>2\<^sub>1)
 next
   case BinOpThrow1 thus ?case  by(fastforce intro!:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case Var thus ?case
     by(force intro!:Var\<^sub>1 simp add: map_le_def fun_upds_apply)
 next
   case LAss thus ?case
     by(fastforce simp add: LAss_lem intro:eval\<^sub>1_evals\<^sub>1.intros
                 dest:eval\<^sub>1_preserves_len)
 next
   case LAssThrow thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case FAcc thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case FAccNull thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case FAccThrow thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (FAss e\<^sub>1 h l a h\<^sub>1 l\<^sub>1 e\<^sub>2 v h\<^sub>2 l\<^sub>2 C fs fs' F D h\<^sub>2')
   have "PROP ?P e\<^sub>1 h l (addr a) h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with FAss.prems
   obtain ls\<^sub>1 where 1: "?Post e\<^sub>1 h l (addr a) h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>2 h\<^sub>1 l\<^sub>1 (Val v) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 FAss.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>2 h\<^sub>1 l\<^sub>1 (Val v) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 FAss show ?case by(auto intro!:FAss\<^sub>1)
 next
   case (FAssNull e\<^sub>1 h l h\<^sub>1 l\<^sub>1 e\<^sub>2 v h\<^sub>2 l\<^sub>2 F D)
   have "PROP ?P e\<^sub>1 h l null h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with FAssNull.prems
   obtain ls\<^sub>1 where 1: "?Post e\<^sub>1 h l null h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>2 h\<^sub>1 l\<^sub>1 (Val v) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 FAssNull.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>2 h\<^sub>1 l\<^sub>1 (Val v) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2" by(auto)
   from 1 2 FAssNull show ?case by(auto intro!:FAssNull\<^sub>1)
 next
   case FAssThrow1 thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (FAssThrow2 e\<^sub>1 h l v h\<^sub>1 l\<^sub>1 e\<^sub>2 e h\<^sub>2 l\<^sub>2 F D)
   have "PROP ?P e\<^sub>1 h l (Val v) h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with FAssThrow2.prems
   obtain ls\<^sub>1 where 1: "?Post e\<^sub>1 h l (Val v) h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"   by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>2 h\<^sub>1 l\<^sub>1 (throw e) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 FAssThrow2.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>2 h\<^sub>1 l\<^sub>1 (throw e) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 FAssThrow2 show ?case by(auto intro!:FAssThrow\<^sub>2\<^sub>1)
 next
   case (CallNull e h l h\<^sub>1 l\<^sub>1 es vs h\<^sub>2 l\<^sub>2 M)
   have "PROP ?P e h l null h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with CallNull.prems
   obtain ls\<^sub>1 where 1: "?Post e h l null h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?Ps es h\<^sub>1 l\<^sub>1 (map Val vs) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 CallNull.prems
   obtain ls\<^sub>2 where 2: "?Posts es h\<^sub>1 l\<^sub>1 (map Val vs) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2" by(auto)
   from 1 2 CallNull show ?case
     by (auto simp add: comp_def elim!: CallNull\<^sub>1)
 next
   case CallObjThrow thus ?case  by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (CallParamsThrow e h l v h\<^sub>1 l\<^sub>1 es vs ex es' h\<^sub>2 l\<^sub>2 M)
   have "PROP ?P e h l (Val v) h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with CallParamsThrow.prems
   obtain ls\<^sub>1 where 1: "?Post e h l (Val v) h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?Ps es h\<^sub>1 l\<^sub>1 (map Val vs @ throw ex # es') h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 CallParamsThrow.prems
   obtain ls\<^sub>2 where 2: "?Posts es h\<^sub>1 l\<^sub>1 (map Val vs @ throw ex # es') h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2" by(auto)
   from 1 2 CallParamsThrow show ?case
     by (auto simp add: comp_def
              elim!: CallParamsThrow\<^sub>1 dest!:evals_final)
 next
   case (Call e h l a h\<^sub>1 l\<^sub>1 es vs h\<^sub>2 l\<^sub>2 C fs M Ts T pns body D l\<^sub>2' b' h\<^sub>3 l\<^sub>3)
   have "PROP ?P e h l (addr a) h\<^sub>1 l\<^sub>1 Vs ls" by fact
   with Call.prems
   obtain ls\<^sub>1 where 1: "?Post e h l (addr a) h\<^sub>1 l\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?Ps es h\<^sub>1 l\<^sub>1 (map Val vs) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 Call.prems
   obtain ls\<^sub>2 where 2: "?Posts es h\<^sub>1 l\<^sub>1 (map Val vs) h\<^sub>2 l\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"
     "size ls\<^sub>1 = size ls\<^sub>2"    by(auto intro!:evals\<^sub>1_preserves_len)
   let ?Vs = "this#pns"
   let ?ls = "Addr a # vs @ replicate (max_vars body) undefined"
   have mdecl: "P \<turnstile> C sees M: Ts\<rightarrow>T = (pns, body) in D" by fact
   have fv_body: "fv body \<subseteq> set ?Vs" and wf_size: "size Ts = size pns"
     using wf mdecl by(auto dest!:sees_wf_mdecl simp:wf_mdecl_def)
   have mdecl\<^sub>1: "compP\<^sub>1 P \<turnstile> C sees M: Ts\<rightarrow>T = (compE\<^sub>1 ?Vs body) in D"
     using sees_method_compP[OF mdecl, of "\<lambda>(pns,e). compE\<^sub>1 (this#pns) e"]
     by(simp)
   have [simp]: "l\<^sub>2' = [this \<mapsto> Addr a, pns [\<mapsto>] vs]" by fact
   have Call_size: "size vs = size pns" by fact
   have "PROP ?P body h\<^sub>2 l\<^sub>2' b' h\<^sub>3 l\<^sub>3 ?Vs ?ls" by fact
   with 1 2 fv_body Call_size Call.prems
   obtain ls\<^sub>3 where 3: "?Post body h\<^sub>2 l\<^sub>2' b' h\<^sub>3 l\<^sub>3 ?Vs ?ls ls\<^sub>3"  by(auto)
   have hp: "h\<^sub>2 a = Some (C, fs)" by fact
   from 1 2 3 hp mdecl\<^sub>1 wf_size Call_size show ?case
     by(fastforce simp add: comp_def
                 intro!: Call\<^sub>1 dest!:evals_final)
 qed
 (*>*)
 
 
 subsection\<open>Preservation of well-formedness\<close>
 
 text\<open>The compiler preserves well-formedness. Is less trivial than it
 may appear. We start with two simple properties: preservation of
 well-typedness\<close>
 
 lemma compE\<^sub>1_pres_wt: "\<And>Vs Ts U.
   \<lbrakk> P,[Vs[\<mapsto>]Ts] \<turnstile> e :: U; size Ts = size Vs \<rbrakk>
   \<Longrightarrow> compP f P,Ts \<turnstile>\<^sub>1 compE\<^sub>1 Vs e :: U"
 and  "\<And>Vs Ts Us.
   \<lbrakk> P,[Vs[\<mapsto>]Ts] \<turnstile> es [::] Us; size Ts = size Vs \<rbrakk>
   \<Longrightarrow> compP f P,Ts \<turnstile>\<^sub>1 compEs\<^sub>1 Vs es [::] Us"
 (*<*)
-apply(induct e and es rule: compE\<^sub>1.induct compEs\<^sub>1.induct)
-apply clarsimp
-apply(fastforce)
-apply clarsimp
-apply(fastforce split:bop.splits)
-apply (fastforce simp:map_upds_apply_eq_Some split:if_split_asm)
-apply (fastforce simp:map_upds_apply_eq_Some split:if_split_asm)
-apply (fastforce)
-apply (fastforce)
-apply (fastforce dest!: sees_method_compP[where f = f])
-apply (fastforce simp:nth_append)
-apply (fastforce)
-apply (fastforce)
-apply (fastforce)
-apply (fastforce)
-apply (fastforce simp:nth_append)
-apply simp
-apply (fastforce)
-done
+proof(induct e and es rule: compE\<^sub>1.induct compEs\<^sub>1.induct)
+  case Var then show ?case
+    by (fastforce simp:map_upds_apply_eq_Some split:if_split_asm)
+next
+  case LAss then show ?case
+    by (fastforce simp:map_upds_apply_eq_Some split:if_split_asm)
+next
+  case Call then show ?case
+    by (fastforce dest!: sees_method_compP[where f = f])
+next
+  case Block then show ?case by (fastforce simp:nth_append)
+next
+  case TryCatch then show ?case by (fastforce simp:nth_append)
+qed fastforce+
 (*>*)
 
 text\<open>\noindent and the correct block numbering:\<close>
 
 lemma \<B>: "\<And>Vs n. size Vs = n \<Longrightarrow> \<B> (compE\<^sub>1 Vs e) n"
 and \<B>s: "\<And>Vs n. size Vs = n \<Longrightarrow> \<B>s (compEs\<^sub>1 Vs es) n"
-(*<*)apply (induction e and es rule: \<B>.induct \<B>s.induct)
-                  apply (auto dest: sym)
-   apply (metis length_append_singleton)
-  apply (metis length_append_singleton)
-  done(*>*)
+(*<*)by (induct e and es rule: \<B>.induct \<B>s.induct)
+        (force | simp,metis length_append_singleton)+(*>*)
 
 text\<open>The main complication is preservation of definite assignment
 @{term"\<D>"}.\<close>
 
 lemma image_last_index: "A \<subseteq> set(xs@[x]) \<Longrightarrow> last_index (xs @ [x]) ` A =
   (if x \<in> A then insert (size xs) (last_index xs ` (A-{x})) else last_index xs ` A)"
 (*<*)
 by(auto simp:image_def)
 (*>*)
 
 
 lemma A_compE\<^sub>1_None[simp]:
       "\<And>Vs. \<A> e = None \<Longrightarrow> \<A> (compE\<^sub>1 Vs e) = None"
 and "\<And>Vs. \<A>s es = None \<Longrightarrow> \<A>s (compEs\<^sub>1 Vs es) = None"
 (*<*)by(induct e and es rule: compE\<^sub>1.induct compEs\<^sub>1.induct)(auto simp:hyperset_defs)(*>*)
 
 
 lemma A_compE\<^sub>1:
       "\<And>A Vs. \<lbrakk> \<A> e = \<lfloor>A\<rfloor>; fv e \<subseteq> set Vs \<rbrakk> \<Longrightarrow> \<A> (compE\<^sub>1 Vs e) = \<lfloor>last_index Vs ` A\<rfloor>"
 and "\<And>A Vs. \<lbrakk> \<A>s es = \<lfloor>A\<rfloor>; fvs es \<subseteq> set Vs \<rbrakk> \<Longrightarrow> \<A>s (compEs\<^sub>1 Vs es) = \<lfloor>last_index Vs ` A\<rfloor>"
 (*<*)
 proof(induct e and es rule: fv.induct fvs.induct)
   case (Block V' T e)
   hence "fv e \<subseteq> set (Vs@[V'])" by fastforce
   moreover obtain B where "\<A> e = \<lfloor>B\<rfloor>"
     using Block.prems by(simp add: hyperset_defs)
   moreover from calculation have "B \<subseteq> set (Vs@[V'])" by(auto dest!:A_fv)
   ultimately show ?case using Block
     by(auto simp add: hyperset_defs image_last_index last_index_size_conv)
 next
   case (TryCatch e\<^sub>1 C V' e\<^sub>2)
   hence fve\<^sub>2: "fv e\<^sub>2 \<subseteq> set (Vs@[V'])" by auto
   show ?case
   proof (cases "\<A> e\<^sub>1")
     assume A\<^sub>1: "\<A> e\<^sub>1 = None"
     then obtain A\<^sub>2 where A\<^sub>2: "\<A> e\<^sub>2 = \<lfloor>A\<^sub>2\<rfloor>" using TryCatch
       by(simp add:hyperset_defs)
     hence "A\<^sub>2 \<subseteq> set (Vs@[V'])" using TryCatch.prems A_fv[OF A\<^sub>2] by simp blast
     thus ?thesis using TryCatch fve\<^sub>2 A\<^sub>1 A\<^sub>2
       by(auto simp add:hyperset_defs image_last_index last_index_size_conv)
   next
     fix A\<^sub>1 assume A\<^sub>1: "\<A> e\<^sub>1 =  \<lfloor>A\<^sub>1\<rfloor>"
     show ?thesis
     proof (cases  "\<A> e\<^sub>2")
       assume A\<^sub>2: "\<A> e\<^sub>2 = None"
       then show ?case using TryCatch A\<^sub>1 by(simp add:hyperset_defs)
     next
       fix A\<^sub>2 assume A\<^sub>2: "\<A> e\<^sub>2 = \<lfloor>A\<^sub>2\<rfloor>"
       have "A\<^sub>1 \<subseteq> set Vs" using TryCatch.prems A_fv[OF A\<^sub>1] by simp blast
       moreover
       have "A\<^sub>2 \<subseteq> set (Vs@[V'])" using TryCatch.prems A_fv[OF A\<^sub>2] by simp blast
       ultimately show ?thesis using TryCatch A\<^sub>1 A\<^sub>2
         by (auto simp add: Diff_subset_conv last_index_size_conv subsetD hyperset_defs dest!: sym [of _ A])
     qed
   qed
 next
   case (Cond e e\<^sub>1 e\<^sub>2)
   { assume "\<A> e = None \<or> \<A> e\<^sub>1 = None \<or> \<A> e\<^sub>2 = None"
     hence ?case using Cond by (auto simp add: hyperset_defs)
   }
   moreover
   { fix A A\<^sub>1 A\<^sub>2
     assume "\<A> e = \<lfloor>A\<rfloor>" and A\<^sub>1: "\<A> e\<^sub>1 = \<lfloor>A\<^sub>1\<rfloor>" and A\<^sub>2: "\<A> e\<^sub>2 = \<lfloor>A\<^sub>2\<rfloor>"
     moreover
     have "A\<^sub>1 \<subseteq> set Vs" using Cond.prems A_fv[OF A\<^sub>1] by simp blast
     moreover
     have "A\<^sub>2 \<subseteq> set Vs" using Cond.prems A_fv[OF A\<^sub>2] by simp blast
     ultimately have ?case using Cond
       by(auto simp add:hyperset_defs image_Un
           inj_on_image_Int[OF inj_on_last_index])
   }
   ultimately show ?case by fastforce
 qed (auto simp add:hyperset_defs)
 (*>*)
 
 
 lemma D_None[iff]: "\<D> (e::'a exp) None" and [iff]: "\<D>s (es::'a exp list) None"
 (*<*)by(induct e and es rule: \<D>.induct \<D>s.induct)(simp_all)(*>*)
 
 
 lemma D_last_index_compE\<^sub>1:
       "\<And>A Vs. \<lbrakk> A \<subseteq> set Vs; fv e \<subseteq> set Vs \<rbrakk> \<Longrightarrow>
                 \<D> e \<lfloor>A\<rfloor> \<Longrightarrow> \<D> (compE\<^sub>1 Vs e) \<lfloor>last_index Vs ` A\<rfloor>"
 and "\<And>A Vs. \<lbrakk> A \<subseteq> set Vs; fvs es \<subseteq> set Vs \<rbrakk> \<Longrightarrow>
                 \<D>s es \<lfloor>A\<rfloor> \<Longrightarrow> \<D>s (compEs\<^sub>1 Vs es) \<lfloor>last_index Vs ` A\<rfloor>"
 (*<*)
 proof(induct e and es rule: \<D>.induct \<D>s.induct)
   case (BinOp e\<^sub>1 bop e\<^sub>2)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e\<^sub>1")
     case None thus ?thesis using BinOp by simp
   next
     case (Some A\<^sub>1)
     have indexA\<^sub>1: "\<A> (compE\<^sub>1 Vs e\<^sub>1) = \<lfloor>last_index Vs ` A\<^sub>1\<rfloor>"
       using A_compE\<^sub>1[OF Some] BinOp.prems  by auto
     have "A \<union> A\<^sub>1 \<subseteq> set Vs" using BinOp.prems A_fv[OF Some] by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` (A \<union> A\<^sub>1)\<rfloor>" using BinOp Some by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` A \<union> last_index Vs ` A\<^sub>1\<rfloor>"
       by(simp add: image_Un)
     thus ?thesis using IH\<^sub>1 indexA\<^sub>1 by auto
   qed
 next
   case (FAss e\<^sub>1 F D e\<^sub>2)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e\<^sub>1")
     case None thus ?thesis using FAss by simp
   next
     case (Some A\<^sub>1)
     have indexA\<^sub>1: "\<A> (compE\<^sub>1 Vs e\<^sub>1) = \<lfloor>last_index Vs ` A\<^sub>1\<rfloor>"
       using A_compE\<^sub>1[OF Some] FAss.prems  by auto
     have "A \<union> A\<^sub>1 \<subseteq> set Vs" using FAss.prems A_fv[OF Some] by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` (A \<union> A\<^sub>1)\<rfloor>" using FAss Some by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` A \<union> last_index Vs ` A\<^sub>1\<rfloor>"
       by(simp add: image_Un)
     thus ?thesis using IH\<^sub>1 indexA\<^sub>1 by auto
   qed
 next
   case (Call e\<^sub>1 M es)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e\<^sub>1")
     case None thus ?thesis using Call by simp
   next
     case (Some A\<^sub>1)
     have indexA\<^sub>1: "\<A> (compE\<^sub>1 Vs e\<^sub>1) = \<lfloor>last_index Vs ` A\<^sub>1\<rfloor>"
       using A_compE\<^sub>1[OF Some] Call.prems  by auto
     have "A \<union> A\<^sub>1 \<subseteq> set Vs" using Call.prems A_fv[OF Some] by auto
     hence "\<D>s (compEs\<^sub>1 Vs es) \<lfloor>last_index Vs ` (A \<union> A\<^sub>1)\<rfloor>" using Call Some by auto
     hence "\<D>s (compEs\<^sub>1 Vs es) \<lfloor>last_index Vs ` A \<union> last_index Vs ` A\<^sub>1\<rfloor>"
       by(simp add: image_Un)
     thus ?thesis using IH\<^sub>1 indexA\<^sub>1 by auto
   qed
 next
   case (TryCatch e\<^sub>1 C V e\<^sub>2)
   have "\<lbrakk> A\<union>{V} \<subseteq> set(Vs@[V]); fv e\<^sub>2 \<subseteq> set(Vs@[V]); \<D> e\<^sub>2 \<lfloor>A\<union>{V}\<rfloor>\<rbrakk> \<Longrightarrow>
         \<D> (compE\<^sub>1 (Vs@[V]) e\<^sub>2) \<lfloor>last_index (Vs@[V]) ` (A\<union>{V})\<rfloor>" by fact
   hence "\<D> (compE\<^sub>1 (Vs@[V]) e\<^sub>2) \<lfloor>last_index (Vs@[V]) ` (A\<union>{V})\<rfloor>"
     using TryCatch.prems by(simp add:Diff_subset_conv)
   moreover have "last_index (Vs@[V]) ` A \<subseteq> last_index Vs ` A \<union> {size Vs}"
     using TryCatch.prems by(auto simp add: image_last_index split:if_split_asm)
   ultimately show ?case using TryCatch
     by(auto simp:hyperset_defs elim!:D_mono')
 next
   case (Seq e\<^sub>1 e\<^sub>2)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e\<^sub>1")
     case None thus ?thesis using Seq by simp
   next
     case (Some A\<^sub>1)
     have indexA\<^sub>1: "\<A> (compE\<^sub>1 Vs e\<^sub>1) = \<lfloor>last_index Vs ` A\<^sub>1\<rfloor>"
       using A_compE\<^sub>1[OF Some] Seq.prems  by auto
     have "A \<union> A\<^sub>1 \<subseteq> set Vs" using Seq.prems A_fv[OF Some] by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` (A \<union> A\<^sub>1)\<rfloor>" using Seq Some by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` A \<union> last_index Vs ` A\<^sub>1\<rfloor>"
       by(simp add: image_Un)
     thus ?thesis using IH\<^sub>1 indexA\<^sub>1 by auto
   qed
 next
   case (Cond e e\<^sub>1 e\<^sub>2)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e")
     case None thus ?thesis using Cond by simp
   next
     case (Some B)
     have indexB: "\<A> (compE\<^sub>1 Vs e) = \<lfloor>last_index Vs ` B\<rfloor>"
       using A_compE\<^sub>1[OF Some] Cond.prems  by auto
     have "A \<union> B \<subseteq> set Vs" using Cond.prems A_fv[OF Some] by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` (A \<union> B)\<rfloor>"
       and "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` (A \<union> B)\<rfloor>"
       using Cond Some by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A \<union> last_index Vs ` B\<rfloor>"
       and "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` A \<union> last_index Vs ` B\<rfloor>"
       by(simp add: image_Un)+
     thus ?thesis using IH\<^sub>1 indexB by auto
   qed
 next
   case (While e\<^sub>1 e\<^sub>2)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e\<^sub>1")
     case None thus ?thesis using While by simp
   next
     case (Some A\<^sub>1)
     have indexA\<^sub>1: "\<A> (compE\<^sub>1 Vs e\<^sub>1) = \<lfloor>last_index Vs ` A\<^sub>1\<rfloor>"
       using A_compE\<^sub>1[OF Some] While.prems  by auto
     have "A \<union> A\<^sub>1 \<subseteq> set Vs" using While.prems A_fv[OF Some] by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` (A \<union> A\<^sub>1)\<rfloor>" using While Some by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` A \<union> last_index Vs ` A\<^sub>1\<rfloor>"
       by(simp add: image_Un)
     thus ?thesis using IH\<^sub>1 indexA\<^sub>1 by auto
   qed
 next
   case (Block V T e)
   have "\<lbrakk> A-{V} \<subseteq> set(Vs@[V]); fv e \<subseteq> set(Vs@[V]); \<D> e \<lfloor>A-{V}\<rfloor> \<rbrakk> \<Longrightarrow>
         \<D> (compE\<^sub>1 (Vs@[V]) e) \<lfloor>last_index (Vs@[V]) ` (A-{V})\<rfloor>" by fact
   hence "\<D> (compE\<^sub>1 (Vs@[V]) e) \<lfloor>last_index (Vs@[V]) ` (A-{V})\<rfloor>"
     using Block.prems by(simp add:Diff_subset_conv)
   moreover have "size Vs \<notin> last_index Vs ` A"
     using Block.prems by(auto simp add:image_def size_last_index_conv)
   ultimately show ?case using Block
     by(auto simp add: image_last_index Diff_subset_conv hyperset_defs elim!: D_mono')
 next
   case (Cons_exp e\<^sub>1 es)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e\<^sub>1")
     case None thus ?thesis using Cons_exp by simp
   next
     case (Some A\<^sub>1)
     have indexA\<^sub>1: "\<A> (compE\<^sub>1 Vs e\<^sub>1) = \<lfloor>last_index Vs ` A\<^sub>1\<rfloor>"
       using A_compE\<^sub>1[OF Some] Cons_exp.prems  by auto
     have "A \<union> A\<^sub>1 \<subseteq> set Vs" using Cons_exp.prems A_fv[OF Some] by auto
     hence "\<D>s (compEs\<^sub>1 Vs es) \<lfloor>last_index Vs ` (A \<union> A\<^sub>1)\<rfloor>" using Cons_exp Some by auto
     hence "\<D>s (compEs\<^sub>1 Vs es) \<lfloor>last_index Vs ` A \<union> last_index Vs ` A\<^sub>1\<rfloor>"
       by(simp add: image_Un)
     thus ?thesis using IH\<^sub>1 indexA\<^sub>1 by auto
   qed
 qed (simp_all add:hyperset_defs)
 (*>*)
 
 
 lemma last_index_image_set: "distinct xs \<Longrightarrow> last_index xs ` set xs = {..<size xs}"
 (*<*)by(induct xs rule:rev_induct) (auto simp add: image_last_index)(*>*)
 
 
 lemma D_compE\<^sub>1:
   "\<lbrakk> \<D> e \<lfloor>set Vs\<rfloor>; fv e \<subseteq> set Vs; distinct Vs \<rbrakk> \<Longrightarrow> \<D> (compE\<^sub>1 Vs e) \<lfloor>{..<length Vs}\<rfloor>"
 (*<*)by(fastforce dest!: D_last_index_compE\<^sub>1[OF subset_refl] simp add:last_index_image_set)(*>*)
 
 
 lemma D_compE\<^sub>1':
 assumes "\<D> e \<lfloor>set(V#Vs)\<rfloor>" and "fv e \<subseteq> set(V#Vs)" and "distinct(V#Vs)"
 shows "\<D> (compE\<^sub>1 (V#Vs) e) \<lfloor>{..length Vs}\<rfloor>"
 (*<*)
 proof -
   have "{..size Vs} = {..<size(V#Vs)}" by auto
   thus ?thesis using assms by (simp only:)(rule D_compE\<^sub>1)
 qed
 (*>*)
 
 
 lemma compP\<^sub>1_pres_wf: "wf_J_prog P \<Longrightarrow> wf_J\<^sub>1_prog (compP\<^sub>1 P)"
 (*<*)
-apply simp
-apply(rule wf_prog_compPI)
- prefer 2 apply assumption
-apply(case_tac m)
-apply(simp add:wf_mdecl_def wf_J\<^sub>1_mdecl_def wf_J_mdecl)
-apply(clarify)
-apply(frule WT_fv)
-apply(fastforce intro!: compE\<^sub>1_pres_wt D_compE\<^sub>1' \<B>)
-done
+proof -
+  assume wf: "wf_J_prog P"
+  let ?f = "(\<lambda>(pns, body). compE\<^sub>1 (this # pns) body)"
+  let ?wf\<^sub>2 = "wf_J\<^sub>1_mdecl"
+
+  { fix C M b Ts T m
+    assume cM: "P \<turnstile> C sees M :  Ts\<rightarrow>T = m in C"
+      and wfm: "wf_mdecl wf_J_mdecl P C (M, Ts, T, m)"
+    obtain pns body where [simp]: "m = (pns, body)" by(cases m) simp
+    let ?E = "[pns [\<mapsto>] Ts, this \<mapsto> Class C]"
+    obtain T' where WT: "P,?E \<turnstile> body :: T'" and subT: "P \<turnstile> T' \<le> T"
+      using wfm by(auto simp: wf_mdecl_def)
+    have fv: "fv body \<subseteq> dom ?E" by(rule WT_fv[OF WT])
+    have "wf_mdecl ?wf\<^sub>2 (compP ?f P) C (M, Ts, T, ?f m)" using cM wfm fv
+      by(clarsimp simp add:wf_mdecl_def wf_J\<^sub>1_mdecl_def)
+        (fastforce intro!: compE\<^sub>1_pres_wt D_compE\<^sub>1' \<B>)
+  }
+  then show ?thesis by simp (rule wf_prog_compPI[OF _ wf])
+qed
 (*>*)
 
 
 end
diff --git a/thys/Jinja/Compiler/Correctness2.thy b/thys/Jinja/Compiler/Correctness2.thy
--- a/thys/Jinja/Compiler/Correctness2.thy
+++ b/thys/Jinja/Compiler/Correctness2.thy
@@ -1,1090 +1,1145 @@
 (*  Title:      Jinja/Compiler/Correctness2.thy
     Author:     Tobias Nipkow
     Copyright   TUM 2003
 *)
 
 section \<open>Correctness of Stage 2\<close>
 
 theory Correctness2
 imports "HOL-Library.Sublist" Compiler2
 begin
 
 (*<*)hide_const (open) Throw(*>*)
 
 subsection\<open>Instruction sequences\<close>
 
 text\<open>How to select individual instructions and subsequences of
 instructions from a program given the class, method and program
 counter.\<close>
 
 definition before :: "jvm_prog \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> nat \<Rightarrow> instr list \<Rightarrow> bool"
    ("(_,_,_,_/ \<rhd> _)" [51,0,0,0,51] 50) where
  "P,C,M,pc \<rhd> is \<longleftrightarrow> prefix is (drop pc (instrs_of P C M))"
 
 definition at :: "jvm_prog \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> nat \<Rightarrow> instr \<Rightarrow> bool"
    ("(_,_,_,_/ \<triangleright> _)" [51,0,0,0,51] 50) where
  "P,C,M,pc \<triangleright> i \<longleftrightarrow> (\<exists>is. drop pc (instrs_of P C M) = i#is)"
 
 lemma [simp]: "P,C,M,pc \<rhd> []"
 (*<*)by(simp add:before_def)(*>*)
 
 
 lemma [simp]: "P,C,M,pc \<rhd> (i#is) = (P,C,M,pc \<triangleright> i \<and> P,C,M,pc + 1 \<rhd> is)"
 (*<*)by(fastforce simp add:before_def at_def prefix_def drop_Suc drop_tl)(*>*)
 
 (*<*)
 declare drop_drop[simp del]
 (*>*)
 
 
 lemma [simp]: "P,C,M,pc \<rhd> (is\<^sub>1 @ is\<^sub>2) = (P,C,M,pc \<rhd> is\<^sub>1 \<and> P,C,M,pc + size is\<^sub>1 \<rhd> is\<^sub>2)"
 (*<*)
-apply(simp add:before_def prefix_def)
-apply(subst add.commute)
-apply(simp add: drop_drop[symmetric])
-apply fastforce
-done
+by(subst add.commute)
+  (fastforce simp add:before_def prefix_def drop_drop[symmetric])
 (*>*)
 
 (*<*)
 declare drop_drop[simp]
 (*>*)
 
 
 lemma [simp]: "P,C,M,pc \<triangleright> i \<Longrightarrow> instrs_of P C M ! pc = i"
 (*<*)by(clarsimp simp add:at_def strict_prefix_def nth_via_drop)(*>*)
 
 
 lemma beforeM:
   "P \<turnstile> C sees M: Ts\<rightarrow>T = body in D \<Longrightarrow>
   compP\<^sub>2 P,D,M,0 \<rhd> compE\<^sub>2 body @ [Return]"
 (*<*)
-apply(drule sees_method_idemp)
-apply(simp add:before_def compP\<^sub>2_def compMb\<^sub>2_def)
-done
+by(drule sees_method_idemp)
+  (simp add:before_def compP\<^sub>2_def compMb\<^sub>2_def)
 (*>*)
 
 text\<open>This lemma executes a single instruction by rewriting:\<close>
 
 lemma [simp]:
   "P,C,M,pc \<triangleright> instr \<Longrightarrow>
   (P \<turnstile> (None, h, (vs,ls,C,M,pc) # frs) -jvm\<rightarrow> \<sigma>') =
   ((None, h, (vs,ls,C,M,pc) # frs) = \<sigma>' \<or>
    (\<exists>\<sigma>. exec(P,(None, h, (vs,ls,C,M,pc) # frs)) = Some \<sigma> \<and> P \<turnstile> \<sigma> -jvm\<rightarrow> \<sigma>'))"
 (*<*)
-apply(simp only: exec_all_def)
-apply(blast intro: converse_rtranclE converse_rtrancl_into_rtrancl)
-done
+by(simp only: exec_all_def)
+  (blast intro: converse_rtranclE converse_rtrancl_into_rtrancl)
 (*>*)
 
 
 subsection\<open>Exception tables\<close>
 
 definition pcs :: "ex_table \<Rightarrow> nat set"
 where
   "pcs xt  \<equiv>  \<Union>(f,t,C,h,d) \<in> set xt. {f ..< t}"
 
 lemma pcs_subset:
 shows "\<And>pc d. pcs(compxE\<^sub>2 e pc d) \<subseteq> {pc..<pc+size(compE\<^sub>2 e)}"
 and "\<And>pc d. pcs(compxEs\<^sub>2 es pc d) \<subseteq> {pc..<pc+size(compEs\<^sub>2 es)}"
 (*<*)
-apply(induct e and es rule: compxE\<^sub>2.induct compxEs\<^sub>2.induct)
-apply (simp_all add:pcs_def)
-apply (fastforce split:bop.splits)+
-done
+proof(induct e and es rule: compxE\<^sub>2.induct compxEs\<^sub>2.induct)
+  case Cast then show ?case by (fastforce simp:pcs_def)
+next
+  case BinOp then show ?case by (fastforce simp:pcs_def split:bop.splits)
+next
+  case LAss then show ?case by (fastforce simp: pcs_def)
+next
+  case FAcc then show ?case by (fastforce simp: pcs_def)
+next
+  case FAss then show ?case by (fastforce simp: pcs_def)
+next
+  case Call then show ?case by (fastforce simp: pcs_def)
+next
+  case Seq then show ?case by (fastforce simp: pcs_def)
+next
+  case Cond then show ?case by (fastforce simp: pcs_def)
+next
+  case While then show ?case by (fastforce simp: pcs_def)
+next
+  case throw then show ?case by (fastforce simp: pcs_def)
+next
+  case TryCatch then show ?case by (fastforce simp: pcs_def)
+next
+  case Cons_exp then show ?case by (fastforce simp: pcs_def)
+qed (simp_all add:pcs_def)
 (*>*)
 
 
 lemma [simp]: "pcs [] = {}"
 (*<*)by(simp add:pcs_def)(*>*)
 
 
 lemma [simp]: "pcs (x#xt) = {fst x ..< fst(snd x)} \<union> pcs xt"
 (*<*)by(auto simp add: pcs_def)(*>*)
 
 
 lemma [simp]: "pcs(xt\<^sub>1 @ xt\<^sub>2) = pcs xt\<^sub>1 \<union> pcs xt\<^sub>2"
 (*<*)by(simp add:pcs_def)(*>*)
 
 
 lemma [simp]: "pc < pc\<^sub>0 \<or> pc\<^sub>0+size(compE\<^sub>2 e) \<le> pc \<Longrightarrow> pc \<notin> pcs(compxE\<^sub>2 e pc\<^sub>0 d)"
 (*<*)using pcs_subset by fastforce(*>*)
 
 
 lemma [simp]: "pc < pc\<^sub>0 \<or> pc\<^sub>0+size(compEs\<^sub>2 es) \<le> pc \<Longrightarrow> pc \<notin> pcs(compxEs\<^sub>2 es pc\<^sub>0 d)"
 (*<*)using pcs_subset by fastforce(*>*)
 
 
 lemma [simp]: "pc\<^sub>1 + size(compE\<^sub>2 e\<^sub>1) \<le> pc\<^sub>2 \<Longrightarrow> pcs(compxE\<^sub>2 e\<^sub>1 pc\<^sub>1 d\<^sub>1) \<inter> pcs(compxE\<^sub>2 e\<^sub>2 pc\<^sub>2 d\<^sub>2) = {}"
 (*<*)using pcs_subset by fastforce(*>*)
 
 
 lemma [simp]: "pc\<^sub>1 + size(compE\<^sub>2 e) \<le> pc\<^sub>2 \<Longrightarrow> pcs(compxE\<^sub>2 e pc\<^sub>1 d\<^sub>1) \<inter> pcs(compxEs\<^sub>2 es pc\<^sub>2 d\<^sub>2) = {}"
 (*<*)using pcs_subset by fastforce(*>*)
 
 
 lemma [simp]:
  "pc \<notin> pcs xt\<^sub>0 \<Longrightarrow> match_ex_table P C pc (xt\<^sub>0 @ xt\<^sub>1) = match_ex_table P C pc xt\<^sub>1"
 (*<*)by (induct xt\<^sub>0) (auto simp: matches_ex_entry_def)(*>*)
 
 
 lemma [simp]: "\<lbrakk> x \<in> set xt; pc \<notin> pcs xt \<rbrakk> \<Longrightarrow> \<not> matches_ex_entry P D pc x"
 (*<*)by(auto simp:matches_ex_entry_def pcs_def)(*>*)
 
 
 lemma [simp]:
 assumes xe: "xe \<in> set(compxE\<^sub>2 e pc d)" and outside: "pc' < pc \<or> pc+size(compE\<^sub>2 e) \<le> pc'"
 shows "\<not> matches_ex_entry P C pc' xe"
 (*<*)
 proof
   assume "matches_ex_entry P C pc' xe"
   with xe have "pc' \<in> pcs(compxE\<^sub>2 e pc d)"
     by(force simp add:matches_ex_entry_def pcs_def)
   with outside show False by simp
 qed
 (*>*)
 
 
 lemma [simp]:
 assumes xe: "xe \<in> set(compxEs\<^sub>2 es pc d)" and outside: "pc' < pc \<or> pc+size(compEs\<^sub>2 es) \<le> pc'"
 shows "\<not> matches_ex_entry P C pc' xe"
 (*<*)
 proof
   assume "matches_ex_entry P C pc' xe"
   with xe have "pc' \<in> pcs(compxEs\<^sub>2 es pc d)"
     by(force simp add:matches_ex_entry_def pcs_def)
   with outside show False by simp
 qed
 (*>*)
 
 
 lemma match_ex_table_app[simp]:
   "\<forall>xte \<in> set xt\<^sub>1. \<not> matches_ex_entry P D pc xte \<Longrightarrow>
   match_ex_table P D pc (xt\<^sub>1 @ xt) = match_ex_table P D pc xt"
 (*<*)by(induct xt\<^sub>1) simp_all(*>*)
 
 
 lemma [simp]:
   "\<forall>x \<in> set xtab. \<not> matches_ex_entry P C pc x \<Longrightarrow>
   match_ex_table P C pc xtab = None"
 (*<*)using match_ex_table_app[where ?xt = "[]"] by fastforce(*>*)
 
 
 lemma match_ex_entry:
   "matches_ex_entry P C pc (start, end, catch_type, handler) =
   (start \<le> pc \<and> pc < end \<and>  P \<turnstile> C \<preceq>\<^sup>* catch_type)"
 (*<*)by(simp add:matches_ex_entry_def)(*>*)
 
 
 definition caught :: "jvm_prog \<Rightarrow> pc \<Rightarrow> heap \<Rightarrow> addr \<Rightarrow> ex_table \<Rightarrow> bool" where
   "caught P pc h a xt \<longleftrightarrow>
   (\<exists>entry \<in> set xt. matches_ex_entry P (cname_of h a) pc entry)"
 
 definition beforex :: "jvm_prog \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> ex_table \<Rightarrow> nat set \<Rightarrow> nat \<Rightarrow> bool"
               ("(2_,/_,/_ \<rhd>/ _ /'/ _,/_)" [51,0,0,0,0,51] 50) where
   "P,C,M \<rhd> xt / I,d \<longleftrightarrow>
   (\<exists>xt\<^sub>0 xt\<^sub>1. ex_table_of P C M = xt\<^sub>0 @ xt @ xt\<^sub>1 \<and> pcs xt\<^sub>0 \<inter> I = {} \<and> pcs xt \<subseteq> I \<and>
     (\<forall>pc \<in> I. \<forall>C pc' d'. match_ex_table P C pc xt\<^sub>1 = \<lfloor>(pc',d')\<rfloor> \<longrightarrow> d' \<le> d))"
 
 definition dummyx :: "jvm_prog \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> ex_table \<Rightarrow> nat set \<Rightarrow> nat \<Rightarrow> bool"  ("(2_,_,_ \<triangleright>/ _ '/_,_)" [51,0,0,0,0,51] 50) where
   "P,C,M \<triangleright> xt/I,d \<longleftrightarrow> P,C,M \<rhd> xt/I,d"
 
+abbreviation
+"beforex\<^sub>0 P C M d I xt xt\<^sub>0 xt\<^sub>1
+  \<equiv> ex_table_of P C M = xt\<^sub>0 @ xt @ xt\<^sub>1 \<and> pcs xt\<^sub>0 \<inter> I = {}
+      \<and> pcs xt \<subseteq> I \<and> (\<forall>pc \<in> I. \<forall>C pc' d'. match_ex_table P C pc xt\<^sub>1 = \<lfloor>(pc',d')\<rfloor> \<longrightarrow> d' \<le> d)"
+
+lemma beforex_beforex\<^sub>0_eq:
+ "P,C,M \<rhd> xt / I,d \<equiv> \<exists>xt\<^sub>0 xt\<^sub>1. beforex\<^sub>0 P C M d I xt xt\<^sub>0 xt\<^sub>1"
+using beforex_def by auto
+
+
 lemma beforexD1: "P,C,M \<rhd> xt / I,d \<Longrightarrow> pcs xt \<subseteq> I"
 (*<*)by(auto simp add:beforex_def)(*>*)
 
 
 lemma beforex_mono: "\<lbrakk> P,C,M \<rhd> xt/I,d'; d' \<le> d \<rbrakk> \<Longrightarrow> P,C,M \<rhd> xt/I,d"
 (*<*)by(fastforce simp:beforex_def)(*>*)
 
 
 lemma [simp]: "P,C,M \<rhd> xt/I,d \<Longrightarrow> P,C,M \<rhd> xt/I,Suc d"
 (*<*)by(fastforce intro:beforex_mono)(*>*)
 
 
 lemma beforex_append[simp]:
   "pcs xt\<^sub>1 \<inter> pcs xt\<^sub>2 = {} \<Longrightarrow>
   P,C,M \<rhd> xt\<^sub>1 @ xt\<^sub>2/I,d =
   (P,C,M \<rhd> xt\<^sub>1/I-pcs xt\<^sub>2,d  \<and>  P,C,M \<rhd> xt\<^sub>2/I-pcs xt\<^sub>1,d \<and> P,C,M \<triangleright> xt\<^sub>1@xt\<^sub>2/I,d)"
-(*<*)
-apply(rule iffI)
- prefer 2
- apply(simp add:dummyx_def)
-apply(auto simp add: beforex_def dummyx_def)
- apply(rule_tac x = xt\<^sub>0 in exI)
- apply auto
-apply(rule_tac x = "xt\<^sub>0@xt\<^sub>1" in exI)
-apply auto
-done
+(*<*)(is "?Q \<Longrightarrow> ?P = (?P1 \<and> ?P2 \<and> ?P3)" is "?Q \<Longrightarrow> ?P = ?P123")
+proof -
+  assume pcs: ?Q
+  show ?thesis proof(rule iffI)
+    assume "?P123" then show ?P by(simp add:dummyx_def)
+  next
+    assume hyp: ?P
+    let ?xt = "xt\<^sub>1 @ xt\<^sub>2"
+    let ?beforex = "beforex\<^sub>0 P C M d"
+    obtain xt\<^sub>0 xt\<^sub>1' where beforex: "?beforex I ?xt xt\<^sub>0 xt\<^sub>1'"
+      using hyp by(clarsimp simp: beforex_def)
+    have "\<exists>xt\<^sub>0 xt\<^sub>1'. ?beforex (I - pcs xt\<^sub>2) xt\<^sub>1 xt\<^sub>0 xt\<^sub>1'" \<comment> \<open>?P1\<close>
+      using pcs beforex by(rule_tac x=xt\<^sub>0 in exI) auto
+    moreover have "\<exists>xt\<^sub>0 xt\<^sub>1'. ?beforex (I - pcs xt\<^sub>1) xt\<^sub>2 xt\<^sub>0 xt\<^sub>1'"  \<comment> \<open>?P2\<close>
+      using pcs beforex by(rule_tac x="xt\<^sub>0@xt\<^sub>1" in exI) auto
+    moreover have ?P3 using hyp by(simp add: dummyx_def)
+    ultimately show ?P123 by (simp add: beforex_def)
+  qed
+qed
 (*>*)
 
 
 lemma beforex_appendD1:
-  "\<lbrakk> P,C,M \<rhd> xt\<^sub>1 @ xt\<^sub>2 @ [(f,t,D,h,d)] / I,d;
-    pcs xt\<^sub>1 \<subseteq> J; J \<subseteq> I; J \<inter> pcs xt\<^sub>2 = {} \<rbrakk>
-  \<Longrightarrow> P,C,M \<rhd> xt\<^sub>1 / J,d"
+assumes bx: "P,C,M \<rhd> xt\<^sub>1 @ xt\<^sub>2 @ [(f,t,D,h,d)] / I,d"
+  and pcs: "pcs xt\<^sub>1 \<subseteq> J" and JI: "J \<subseteq> I" and Jpcs: "J \<inter> pcs xt\<^sub>2 = {}"
+shows "P,C,M \<rhd> xt\<^sub>1 / J,d"
 (*<*)
-apply(auto simp:beforex_def)
-apply(rule exI,rule exI,rule conjI, rule refl)
-apply(rule conjI, blast)
-apply(auto)
-apply(subgoal_tac "pc \<notin> pcs xt\<^sub>2")
- prefer 2 apply blast
-apply (auto split:if_split_asm)
-done
+proof -
+  let ?beforex = "beforex\<^sub>0 P C M d"
+  obtain xt\<^sub>0 xt\<^sub>1' where bx': "?beforex I (xt\<^sub>1 @ xt\<^sub>2 @ [(f,t,D,h,d)]) xt\<^sub>0 xt\<^sub>1'"
+    using bx by(clarsimp simp:beforex_def)
+  let ?xt0 = xt\<^sub>0 and ?xt1 = "xt\<^sub>2 @ (f, t, D, h, d) # xt\<^sub>1'"
+  have "pcs xt\<^sub>0 \<inter> J = {}" using bx' JI by blast
+  moreover {
+    fix pc C pc' d' assume pcJ: "pc\<in>J"
+    then have "pc \<notin> pcs xt\<^sub>2" using bx' Jpcs by blast
+    then have "match_ex_table P C pc (xt\<^sub>2 @ (f, t, D, h, d) # xt\<^sub>1')
+                   = \<lfloor>(pc', d')\<rfloor> \<longrightarrow> d' \<le> d"
+      using bx' JI pcJ by (auto split:if_split_asm)
+  }
+  ultimately have "?beforex J xt\<^sub>1 ?xt0 ?xt1" using bx' pcs by simp
+  then show ?thesis using beforex_def by blast
+qed
 (*>*)
 
 
 lemma beforex_appendD2:
-  "\<lbrakk> P,C,M \<rhd> xt\<^sub>1 @ xt\<^sub>2 @ [(f,t,D,h,d)] / I,d;
-    pcs xt\<^sub>2 \<subseteq> J; J \<subseteq> I; J \<inter> pcs xt\<^sub>1 = {} \<rbrakk>
-  \<Longrightarrow> P,C,M \<rhd> xt\<^sub>2 / J,d"
+assumes bx: "P,C,M \<rhd> xt\<^sub>1 @ xt\<^sub>2 @ [(f,t,D,h,d)] / I,d"
+  and pcs: "pcs xt\<^sub>2 \<subseteq> J" and JI: "J \<subseteq> I" and Jpcs: "J \<inter> pcs xt\<^sub>1 = {}"
+shows "P,C,M \<rhd> xt\<^sub>2 / J,d"
 (*<*)
-apply(auto simp:beforex_def)
-apply(rule_tac x = "xt\<^sub>0 @ xt\<^sub>1" in exI)
-apply fastforce
-done
+proof -
+  let ?beforex = "beforex\<^sub>0 P C M d"
+  obtain xt\<^sub>0 xt\<^sub>1' where bx': "?beforex I (xt\<^sub>1 @ xt\<^sub>2 @ [(f,t,D,h,d)]) xt\<^sub>0 xt\<^sub>1'"
+    using bx by(clarsimp simp:beforex_def)
+  then have "\<exists>xt\<^sub>1''. beforex\<^sub>0 P C M d J xt\<^sub>2 (xt\<^sub>0 @ xt\<^sub>1) xt\<^sub>1''"
+    using assms by fastforce
+  then show ?thesis using beforex_def by blast
+qed
 (*>*)
 
 
 lemma beforexM:
   "P \<turnstile> C sees M: Ts\<rightarrow>T = body in D \<Longrightarrow>
   compP\<^sub>2 P,D,M \<rhd> compxE\<^sub>2 body 0 0/{..<size(compE\<^sub>2 body)},0"
 (*<*)
-apply(drule sees_method_idemp)
-apply(drule sees_method_compP[where f = compMb\<^sub>2])
-apply(simp add:beforex_def compP\<^sub>2_def compMb\<^sub>2_def)
-apply(rule_tac x = "[]" in exI)
-using pcs_subset apply fastforce
-done
+proof -
+  assume cM: "P \<turnstile> C sees M: Ts\<rightarrow>T = body in D"
+  let ?xt0 = "[]"
+  have "\<exists>xt1. beforex\<^sub>0 (compP\<^sub>2 P) D M 0 ({..<size(compE\<^sub>2 body)}) (compxE\<^sub>2 body 0 0) ?xt0 xt1"
+    using sees_method_compP[where f = compMb\<^sub>2, OF sees_method_idemp[OF cM]]
+          pcs_subset by(fastforce simp add: compP\<^sub>2_def compMb\<^sub>2_def)
+  then show ?thesis using beforex_def by blast
+qed
 (*>*)
 
 
 lemma match_ex_table_SomeD2:
- "\<lbrakk> match_ex_table P D pc (ex_table_of P C M) = \<lfloor>(pc',d')\<rfloor>;
-    P,C,M \<rhd> xt/I,d; \<forall>x \<in> set xt. \<not> matches_ex_entry P D pc x; pc \<in> I \<rbrakk>
- \<Longrightarrow> d' \<le> d"
+assumes met: "match_ex_table P D pc (ex_table_of P C M) = \<lfloor>(pc',d')\<rfloor>"
+  and bx: "P,C,M \<rhd> xt/I,d"
+  and nmet: "\<forall>x \<in> set xt. \<not> matches_ex_entry P D pc x" and pcI: "pc \<in> I"
+shows "d' \<le> d"
 (*<*)
-apply(auto simp:beforex_def)
-apply(subgoal_tac "pc \<notin> pcs xt\<^sub>0")
-apply auto
-done
+proof -
+  obtain xt\<^sub>0 xt\<^sub>1 where bx': "beforex\<^sub>0 P C M d I xt xt\<^sub>0 xt\<^sub>1"
+    using bx by(clarsimp simp:beforex_def)
+  then have "pc \<notin> pcs xt\<^sub>0" using pcI by blast
+  then show ?thesis using bx' met nmet pcI by simp
+qed
 (*>*)
 
 
 lemma match_ex_table_SomeD1:
   "\<lbrakk> match_ex_table P D pc (ex_table_of P C M) = \<lfloor>(pc',d')\<rfloor>;
      P,C,M \<rhd> xt / I,d; pc \<in> I; pc \<notin> pcs xt \<rbrakk> \<Longrightarrow> d' \<le> d"
 (*<*)by(auto elim: match_ex_table_SomeD2)(*>*)
 
 
 subsection\<open>The correctness proof\<close>
 
 (*<*)
 declare nat_add_distrib[simp] caught_def[simp]
 declare fun_upd_apply[simp del]
 (*>*)
 
 
 definition
   handle :: "jvm_prog \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> addr \<Rightarrow> heap \<Rightarrow> val list \<Rightarrow> val list \<Rightarrow> nat \<Rightarrow> frame list
                 \<Rightarrow> jvm_state" where
   "handle P C M a h vs ls pc frs = find_handler P a h ((vs,ls,C,M,pc) # frs)"
 
 lemma handle_Cons:
  "\<lbrakk> P,C,M \<rhd> xt/I,d; d \<le> size vs; pc \<in> I;
     \<forall>x \<in> set xt. \<not> matches_ex_entry P (cname_of h xa) pc x \<rbrakk> \<Longrightarrow>
   handle P C M xa h (v # vs) ls pc frs = handle P C M xa h vs ls pc frs"
 (*<*)by(auto simp:handle_def Suc_diff_le dest: match_ex_table_SomeD2)(*>*)
 
 lemma handle_append:
- "\<lbrakk> P,C,M \<rhd> xt/I,d; d \<le> size vs; pc \<in> I; pc \<notin> pcs xt \<rbrakk> \<Longrightarrow>
-  handle P C M xa h (ws @ vs) ls pc frs = handle P C M xa h vs ls pc frs"
+assumes bx: "P,C,M \<rhd> xt/I,d" and d: "d \<le> size vs"
+  and pcI: "pc \<in> I" and pc_not: "pc \<notin> pcs xt"
+shows "handle P C M xa h (ws @ vs) ls pc frs = handle P C M xa h vs ls pc frs"
 (*<*)
-apply(auto simp:handle_def)
-apply(rename_tac pc' d')
-apply(subgoal_tac "size ws \<le> length ws + length vs - d'")
-apply(simp add:drop_all)
-apply(fastforce dest:match_ex_table_SomeD2 split:nat_diff_split)
-done
+proof -
+  { fix pc' d'
+    assume "match_ex_table P (cname_of h xa) pc (ex_table_of P C M) = \<lfloor>(pc', d')\<rfloor>"
+    then have "length ws \<le> length ws + length vs - d'"
+      using assms by(fastforce dest:match_ex_table_SomeD2 split:nat_diff_split)
+  }
+  then show ?thesis by(simp add: handle_def)
+qed
 (*>*)
 
 
 lemma aux_isin[simp]: "\<lbrakk> B \<subseteq> A; a \<in> B \<rbrakk> \<Longrightarrow> a \<in> A"
 (*<*)by blast(*>*)
 
 
 lemma fixes P\<^sub>1 defines [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
 shows Jcc:
   "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>e,(h\<^sub>0,ls\<^sub>0)\<rangle> \<Rightarrow> \<langle>ef,(h\<^sub>1,ls\<^sub>1)\<rangle> \<Longrightarrow>
   (\<And>C M pc v xa vs frs I.
      \<lbrakk> P,C,M,pc \<rhd> compE\<^sub>2 e; P,C,M \<rhd> compxE\<^sub>2 e pc (size vs)/I,size vs;
        {pc..<pc+size(compE\<^sub>2 e)} \<subseteq> I \<rbrakk> \<Longrightarrow>
      (ef = Val v \<longrightarrow>
       P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
             (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 e))#frs))
      \<and>
      (ef = Throw xa \<longrightarrow>
       (\<exists>pc\<^sub>1. pc \<le> pc\<^sub>1 \<and> pc\<^sub>1 < pc + size(compE\<^sub>2 e) \<and>
                \<not> caught P pc\<^sub>1 h\<^sub>1 xa (compxE\<^sub>2 e pc (size vs)) \<and>
                P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow> handle P C M xa h\<^sub>1 vs ls\<^sub>1 pc\<^sub>1 frs)))"
 (*<*)
   (is "_ \<Longrightarrow> (\<And>C M pc v xa vs frs I.
                   PROP ?P e h\<^sub>0 ls\<^sub>0 ef h\<^sub>1 ls\<^sub>1 C M pc v xa vs frs I)")
 (*>*)
 
 and "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>es,(h\<^sub>0,ls\<^sub>0)\<rangle> [\<Rightarrow>] \<langle>fs,(h\<^sub>1,ls\<^sub>1)\<rangle> \<Longrightarrow>
     (\<And>C M pc ws xa es' vs frs I.
       \<lbrakk> P,C,M,pc \<rhd> compEs\<^sub>2 es; P,C,M \<rhd> compxEs\<^sub>2 es pc (size vs)/I,size vs;
        {pc..<pc+size(compEs\<^sub>2 es)} \<subseteq> I \<rbrakk> \<Longrightarrow>
       (fs = map Val ws \<longrightarrow>
        P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
              (None,h\<^sub>1,(rev ws @ vs,ls\<^sub>1,C,M,pc+size(compEs\<^sub>2 es))#frs))
       \<and>
       (fs = map Val ws @ Throw xa # es' \<longrightarrow>
        (\<exists>pc\<^sub>1. pc \<le> pc\<^sub>1 \<and> pc\<^sub>1 < pc + size(compEs\<^sub>2 es) \<and>
                 \<not> caught P pc\<^sub>1 h\<^sub>1 xa (compxEs\<^sub>2 es pc (size vs)) \<and>
                 P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow> handle P C M xa h\<^sub>1 vs ls\<^sub>1 pc\<^sub>1 frs)))"
 (*<*)
   (is "_ \<Longrightarrow> (\<And>C M pc ws xa es' vs frs I.
                   PROP ?Ps es h\<^sub>0 ls\<^sub>0 fs h\<^sub>1 ls\<^sub>1 C M pc ws xa es' vs frs I)")
 proof (induct rule:eval\<^sub>1_evals\<^sub>1_inducts)
   case New\<^sub>1 thus ?case by (clarsimp simp add:blank_def fun_eq_iff)
 next
   case NewFail\<^sub>1 thus ?case by(auto simp: handle_def pcs_def)
 next
   case (Cast\<^sub>1 e h\<^sub>0 ls\<^sub>0 a h\<^sub>1 ls\<^sub>1 D fs C')
   let ?pc = "pc + length(compE\<^sub>2 e)"
   have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
              (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc)#frs)" using Cast\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc+1)#frs)"
     using Cast\<^sub>1 by (auto simp add:cast_ok_def)
   finally show ?case by auto
 next
   case (CastNull\<^sub>1 e h\<^sub>0 ls\<^sub>0 h\<^sub>1 ls\<^sub>1 C')
   let ?pc = "pc + length(compE\<^sub>2 e)"
   have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
             (None,h\<^sub>1,(Null#vs,ls\<^sub>1,C,M,?pc)#frs)"
     using CastNull\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(Null#vs,ls\<^sub>1,C,M,?pc+1)#frs)"
     using CastNull\<^sub>1 by (auto simp add:cast_ok_def)
   finally show ?case by auto
 next
   case (CastFail\<^sub>1 e h\<^sub>0 ls\<^sub>0 a h\<^sub>1 ls\<^sub>1 D fs C')
   let ?pc = "pc + length(compE\<^sub>2 e)"
   let ?xa = "addr_of_sys_xcpt ClassCast"
   have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
              (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc)#frs)"
     using CastFail\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>1 (Addr a#vs) ls\<^sub>1 ?pc frs"
     using CastFail\<^sub>1 by (auto simp add:handle_def cast_ok_def)
   also have "handle P C M ?xa h\<^sub>1 (Addr a#vs) ls\<^sub>1 ?pc frs =
              handle P C M ?xa h\<^sub>1 vs ls\<^sub>1 ?pc frs"
     using CastFail\<^sub>1.prems by(auto simp:handle_Cons)
   finally have exec: "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow> \<dots>".
   show ?case (is "?N \<and> (?eq \<longrightarrow> (\<exists>pc\<^sub>1. ?H pc\<^sub>1))")
   proof
     show ?N by simp
   next
     have "?eq \<longrightarrow> ?H ?pc" using exec by auto
     thus "?eq \<longrightarrow> (\<exists>pc\<^sub>1. ?H pc\<^sub>1)" by blast
   qed
 next
   case CastThrow\<^sub>1 thus ?case by fastforce
 next
   case Val\<^sub>1 thus ?case by simp
 next
   case Var\<^sub>1 thus ?case by auto
 next
   case (BinOp\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 v\<^sub>1 h\<^sub>1 ls\<^sub>1 e\<^sub>2 v\<^sub>2 h\<^sub>2 ls\<^sub>2 bop w)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compE\<^sub>2 e\<^sub>2)"
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 (Val v\<^sub>2) h\<^sub>2 ls\<^sub>2 C M ?pc\<^sub>1 v\<^sub>2 xa (v\<^sub>1#vs) frs
                      (I - pcs(compxE\<^sub>2 e\<^sub>1 pc (size vs)))" by fact
   have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
              (None,h\<^sub>1,(v\<^sub>1#vs,ls\<^sub>1,C,M,?pc\<^sub>1)#frs)" using BinOp\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(v\<^sub>2#v\<^sub>1#vs,ls\<^sub>2,C,M,?pc\<^sub>2)#frs)"
     using BinOp\<^sub>1.prems IH\<^sub>2 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(w#vs,ls\<^sub>2,C,M,?pc\<^sub>2+1)#frs)"
     using BinOp\<^sub>1 by(cases bop) auto
   finally show ?case by (auto split: bop.splits simp:add.assoc)
 next
   case BinOpThrow\<^sub>1\<^sub>1 thus ?case by(fastforce)
 next
   case (BinOpThrow\<^sub>2\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 v\<^sub>1 h\<^sub>1 ls\<^sub>1 e\<^sub>2 e h\<^sub>2 ls\<^sub>2 bop)
   let ?pc = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(v\<^sub>1#vs,ls\<^sub>1,C,M,?pc)#frs)"
   have 1: "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow> ?\<sigma>\<^sub>1"
     using BinOpThrow\<^sub>2\<^sub>1 by fastforce
   show ?case (is "?N \<and> (?eq \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2))")
   proof
     show ?N by simp
   next
     { assume ?eq
       moreover
       have "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 (throw e) h\<^sub>2 ls\<^sub>2 C M ?pc v xa (v\<^sub>1#vs) frs
                      (I - pcs(compxE\<^sub>2 e\<^sub>1 pc (size vs)))" by fact
       ultimately obtain pc\<^sub>2 where
         pc\<^sub>2: "?pc \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc + size(compE\<^sub>2 e\<^sub>2) \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 e\<^sub>2 ?pc (size vs + 1))" and
         2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (v\<^sub>1#vs) ls\<^sub>2 pc\<^sub>2 frs"
         using BinOpThrow\<^sub>2\<^sub>1.prems by fastforce
       have 3: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 vs ls\<^sub>2 pc\<^sub>2 frs"
         using 2 BinOpThrow\<^sub>2\<^sub>1.prems pc\<^sub>2 by(auto simp:handle_Cons)
       have "?H pc\<^sub>2" using pc\<^sub>2 jvm_trans[OF 1 3] by auto
       hence "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     }
     thus "?eq \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)" by iprover
   qed
 next
   case (FAcc\<^sub>1 e h\<^sub>0 ls\<^sub>0 a h\<^sub>1 ls\<^sub>1 C fs F D w)
   let ?pc = "pc + length(compE\<^sub>2 e)"
   have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
              (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc)#frs)" using FAcc\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc+1)#frs)"
     using FAcc\<^sub>1 by auto
   finally show ?case by auto
 next
   case (FAccNull\<^sub>1 e h\<^sub>0 ls\<^sub>0 h\<^sub>1 ls\<^sub>1 F D)
   let ?pc = "pc + length(compE\<^sub>2 e)"
   let ?xa = "addr_of_sys_xcpt NullPointer"
   have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
              (None,h\<^sub>1,(Null#vs,ls\<^sub>1,C,M,?pc)#frs)" using FAccNull\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>1 (Null#vs) ls\<^sub>1 ?pc frs"
     using FAccNull\<^sub>1.prems
     by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)
   also have "handle P C M ?xa h\<^sub>1 (Null#vs) ls\<^sub>1 ?pc frs =
              handle P C M ?xa h\<^sub>1 vs ls\<^sub>1 ?pc frs"
     using FAccNull\<^sub>1.prems by(auto simp add:handle_Cons)
   finally show ?case by (auto intro: exI[where x = ?pc])
 next
   case FAccThrow\<^sub>1 thus ?case by fastforce
 next
   case (LAss\<^sub>1 e h\<^sub>0 ls\<^sub>0 w h\<^sub>1 ls\<^sub>1 i ls\<^sub>2)
   let ?pc = "pc + length(compE\<^sub>2 e)"
   have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
              (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc)#frs)" using LAss\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(Unit#vs,ls\<^sub>2,C,M,?pc+2)#frs)"
     using LAss\<^sub>1 by auto
   finally show ?case using LAss\<^sub>1 by auto
 next
   case LAssThrow\<^sub>1 thus ?case by fastforce
 next
   case (FAss\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 a h\<^sub>1 ls\<^sub>1 e\<^sub>2 w h\<^sub>2 ls\<^sub>2 C fs fs' F D h\<^sub>2')
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compE\<^sub>2 e\<^sub>2)"
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 (Val w) h\<^sub>2 ls\<^sub>2 C M ?pc\<^sub>1 w xa (Addr a#vs) frs
                      (I - pcs(compxE\<^sub>2 e\<^sub>1 pc (size vs)))" by fact
   have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
              (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc\<^sub>1)#frs)" using FAss\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(w#Addr a#vs,ls\<^sub>2,C,M,?pc\<^sub>2)#frs)"
     using FAss\<^sub>1.prems IH\<^sub>2 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2',(Unit#vs,ls\<^sub>2,C,M,?pc\<^sub>2+2)#frs)"
     using FAss\<^sub>1 by auto
   finally show ?case using FAss\<^sub>1 by (auto simp:add.assoc)
 next
   case (FAssNull\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 h\<^sub>1 ls\<^sub>1 e\<^sub>2 w h\<^sub>2 ls\<^sub>2 F D)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compE\<^sub>2 e\<^sub>2)"
   let ?xa = "addr_of_sys_xcpt NullPointer"
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 (Val w) h\<^sub>2 ls\<^sub>2 C M ?pc\<^sub>1 w xa (Null#vs) frs
                      (I - pcs(compxE\<^sub>2 e\<^sub>1 pc (size vs)))" by fact
   have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
              (None,h\<^sub>1,(Null#vs,ls\<^sub>1,C,M,?pc\<^sub>1)#frs)" using FAssNull\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(w#Null#vs,ls\<^sub>2,C,M,?pc\<^sub>2)#frs)"
     using FAssNull\<^sub>1.prems IH\<^sub>2 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>2 (w#Null#vs) ls\<^sub>2 ?pc\<^sub>2 frs"
     using FAssNull\<^sub>1.prems
     by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)
   also have "handle P C M ?xa h\<^sub>2 (w#Null#vs) ls\<^sub>2 ?pc\<^sub>2 frs =
              handle P C M ?xa h\<^sub>2 vs ls\<^sub>2 ?pc\<^sub>2 frs"
     using FAssNull\<^sub>1.prems by(auto simp add:handle_Cons)
   finally show ?case by (auto intro: exI[where x = ?pc\<^sub>2])
 next
   case (FAssThrow\<^sub>2\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 w h\<^sub>1 ls\<^sub>1 e\<^sub>2 e' h\<^sub>2 ls\<^sub>2 F D)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc\<^sub>1)#frs)"
   have 1: "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow> ?\<sigma>\<^sub>1"
     using FAssThrow\<^sub>2\<^sub>1 by fastforce
   show ?case (is "?N \<and> (?eq \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2))")
   proof
     show ?N by simp
   next
     { assume ?eq
       moreover
       have "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 (throw e') h\<^sub>2 ls\<^sub>2 C M ?pc\<^sub>1 v xa (w#vs) frs
                     (I - pcs (compxE\<^sub>2 e\<^sub>1 pc (length vs)))" by fact
       ultimately obtain pc\<^sub>2 where
         pc\<^sub>2: "?pc\<^sub>1 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>1 + size(compE\<^sub>2 e\<^sub>2) \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 e\<^sub>2 ?pc\<^sub>1 (size vs + 1))" and
         2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (w#vs) ls\<^sub>2 pc\<^sub>2 frs"
         using FAssThrow\<^sub>2\<^sub>1.prems by fastforce
       have 3: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 vs ls\<^sub>2 pc\<^sub>2 frs"
         using 2 FAssThrow\<^sub>2\<^sub>1.prems pc\<^sub>2 by(auto simp:handle_Cons)
       have "?H pc\<^sub>2" using pc\<^sub>2 jvm_trans[OF 1 3] by auto
       hence "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     }
     thus "?eq \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)" by iprover
   qed
 next
   case FAssThrow\<^sub>1\<^sub>1 thus ?case by fastforce
 next
   case (Call\<^sub>1 e h\<^sub>0 ls\<^sub>0 a h\<^sub>1 ls\<^sub>1 es pvs h\<^sub>2 ls\<^sub>2 Ca fs M' Ts T body D ls\<^sub>2' f h\<^sub>3 ls\<^sub>3)
   have "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>es,(h\<^sub>1, ls\<^sub>1)\<rangle> [\<Rightarrow>] \<langle>map Val pvs,(h\<^sub>2, ls\<^sub>2)\<rangle>" by fact
   hence [simp]: "length es = length pvs" by(auto dest:evals\<^sub>1_preserves_elen)
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs, ls\<^sub>0, C,M,pc)#frs)"
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(Addr a # vs, ls\<^sub>1, C,M,?pc\<^sub>1)#frs)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compEs\<^sub>2 es)"
   let ?frs\<^sub>2 = "(rev pvs @ Addr a # vs, ls\<^sub>2, C,M,?pc\<^sub>2)#frs"
   let ?\<sigma>\<^sub>2 = "(None,h\<^sub>2,?frs\<^sub>2)"
   let ?frs\<^sub>2' = "([], ls\<^sub>2', D,M',0) # ?frs\<^sub>2"
   let ?\<sigma>\<^sub>2' = "(None, h\<^sub>2, ?frs\<^sub>2')"
   have IH_es: "PROP ?Ps es h\<^sub>1 ls\<^sub>1 (map Val pvs) h\<^sub>2 ls\<^sub>2 C M ?pc\<^sub>1 pvs xa
                     (map Val pvs) (Addr a # vs) frs (I - pcs(compxE\<^sub>2 e pc (size vs)))" by fact
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1" using Call\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>2" using IH_es Call\<^sub>1.prems by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>2'"
     using Call\<^sub>1 by(auto simp add: nth_append compMb\<^sub>2_def)
   finally have 1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>2'".
   have "P\<^sub>1 \<turnstile> Ca sees M': Ts\<rightarrow>T = body in D" by fact
   then have M'_in_D: "P\<^sub>1 \<turnstile> D sees M': Ts\<rightarrow>T = body in D"
     by(rule sees_method_idemp) 
   hence M'_code: "compP\<^sub>2 P\<^sub>1,D,M',0 \<rhd> compE\<^sub>2 body @ [Return]"
     and M'_xtab: "compP\<^sub>2 P\<^sub>1,D,M' \<rhd> compxE\<^sub>2 body 0 0/{..<size(compE\<^sub>2 body)},0"
     by(rule beforeM, rule beforexM)
   have IH_body: "PROP ?P body h\<^sub>2 ls\<^sub>2' f h\<^sub>3 ls\<^sub>3 D M' 0 v xa [] ?frs\<^sub>2 ({..<size(compE\<^sub>2 body)})" by fact
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note 1
       also have "P \<turnstile> ?\<sigma>\<^sub>2' -jvm\<rightarrow>
                      (None,h\<^sub>3,([v],ls\<^sub>3,D,M',size(compE\<^sub>2 body))#?frs\<^sub>2)"
         using val IH_body Call\<^sub>1.prems M'_code M'_xtab
         by (fastforce simp del:split_paired_Ex)
       also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None, h\<^sub>3, (v # vs, ls\<^sub>2, C,M,?pc\<^sub>2+1)#frs)"
         using Call\<^sub>1 M'_code M'_in_D by(auto simp: nth_append compMb\<^sub>2_def)
       finally show ?trans by(simp add:add.assoc)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)")
     proof
       assume throw: ?throw
       with IH_body obtain pc\<^sub>2 where
         pc\<^sub>2: "0 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < size(compE\<^sub>2 body) \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>3 xa (compxE\<^sub>2 body 0 0)" and
         2: "P \<turnstile> ?\<sigma>\<^sub>2' -jvm\<rightarrow> handle P D M' xa h\<^sub>3 [] ls\<^sub>3 pc\<^sub>2 ?frs\<^sub>2"
         using Call\<^sub>1.prems M'_code M'_xtab
         by (fastforce simp del:split_paired_Ex)
       have "handle P D M' xa h\<^sub>3 [] ls\<^sub>3 pc\<^sub>2 ?frs\<^sub>2 =
             handle P C M xa h\<^sub>3 (rev pvs @ Addr a # vs) ls\<^sub>2 ?pc\<^sub>2 frs"
         using pc\<^sub>2 M'_in_D by(auto simp add:handle_def)
       also have "\<dots> = handle P C M xa h\<^sub>3 vs ls\<^sub>2 ?pc\<^sub>2 frs"
         using Call\<^sub>1.prems by(auto simp add:handle_append handle_Cons)
       finally have "?H ?pc\<^sub>2" using pc\<^sub>2 jvm_trans[OF 1 2] by auto
       thus "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     qed
   qed
 next
   case (CallParamsThrow\<^sub>1 e h\<^sub>0 ls\<^sub>0 w h\<^sub>1 ls\<^sub>1 es es' h\<^sub>2 ls\<^sub>2 pvs ex es'' M')
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs, ls\<^sub>0, C,M,pc)#frs)"
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(w # vs, ls\<^sub>1, C,M,?pc\<^sub>1)#frs)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compEs\<^sub>2 es)"
   have 1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1" using CallParamsThrow\<^sub>1 by fastforce
   show ?case (is "?N \<and> (?eq \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2))")
   proof
     show ?N by simp
   next
     { assume ?eq
       moreover
       have "PROP ?Ps es h\<^sub>1 ls\<^sub>1 es' h\<^sub>2 ls\<^sub>2 C M ?pc\<^sub>1 pvs xa es'' (w#vs) frs
         (I - pcs (compxE\<^sub>2 e pc (length vs)))" by fact
       ultimately have "\<exists>pc\<^sub>2.
         (?pc\<^sub>1 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>1 + size(compEs\<^sub>2 es) \<and>
          \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxEs\<^sub>2 es ?pc\<^sub>1 (size vs + 1))) \<and>
         P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (w#vs) ls\<^sub>2 pc\<^sub>2 frs"
         (is "\<exists>pc\<^sub>2. ?PC pc\<^sub>2 \<and> ?Exec pc\<^sub>2")
         using CallParamsThrow\<^sub>1 by force
       then obtain pc\<^sub>2 where pc\<^sub>2: "?PC pc\<^sub>2" and 2: "?Exec pc\<^sub>2" by iprover
       have "?H pc\<^sub>2" using pc\<^sub>2 jvm_trans[OF 1 2] CallParamsThrow\<^sub>1
         by(auto simp:handle_Cons)
       hence "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     }
     thus "?eq \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)" by iprover
   qed
 next
   case (CallNull\<^sub>1 e h\<^sub>0 ls\<^sub>0 h\<^sub>1 ls\<^sub>1 es pvs h\<^sub>2 ls\<^sub>2 M')
   have "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>es,(h\<^sub>1, ls\<^sub>1)\<rangle> [\<Rightarrow>] \<langle>map Val pvs,(h\<^sub>2, ls\<^sub>2)\<rangle>" by fact
   hence [simp]: "length es = length pvs" by(auto dest:evals\<^sub>1_preserves_elen)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compEs\<^sub>2 es)"
   let ?xa = "addr_of_sys_xcpt NullPointer"
   have IH_es: "PROP ?Ps es h\<^sub>1 ls\<^sub>1 (map Val pvs) h\<^sub>2 ls\<^sub>2 C M ?pc\<^sub>1 pvs xa
                     (map Val pvs) (Null#vs) frs (I - pcs(compxE\<^sub>2 e pc (size vs)))" by fact
   have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
              (None,h\<^sub>1,(Null#vs,ls\<^sub>1,C,M,?pc\<^sub>1)#frs)" using CallNull\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(rev pvs@Null#vs,ls\<^sub>2,C,M,?pc\<^sub>2)#frs)"
     using CallNull\<^sub>1 IH_es by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>2 (rev pvs@Null#vs) ls\<^sub>2 ?pc\<^sub>2 frs"
     using CallNull\<^sub>1.prems
     by(auto simp:split_beta handle_def nth_append simp del: split_paired_Ex)
   also have "handle P C M ?xa h\<^sub>2 (rev pvs@Null#vs) ls\<^sub>2 ?pc\<^sub>2 frs =
              handle P C M ?xa h\<^sub>2 vs ls\<^sub>2 ?pc\<^sub>2 frs"
     using CallNull\<^sub>1.prems by(auto simp:handle_Cons handle_append)
   finally show ?case by (auto intro: exI[where x = ?pc\<^sub>2])
 next
   case CallObjThrow\<^sub>1 thus ?case by fastforce
 next
   case Block\<^sub>1 thus ?case by auto
 next
   case (Seq\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 w h\<^sub>1 ls\<^sub>1 e\<^sub>2 e\<^sub>2' h\<^sub>2 ls\<^sub>2)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs,ls\<^sub>1,C,M,?pc\<^sub>1+1)#frs)"
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc\<^sub>1)#frs)"
     using Seq\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1" using Seq\<^sub>1 by auto
   finally have eval\<^sub>1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1".
   let ?pc\<^sub>2 = "?pc\<^sub>1 + 1 + length(compE\<^sub>2 e\<^sub>2)"
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 e\<^sub>2' h\<^sub>2 ls\<^sub>2 C M (?pc\<^sub>1+1) v xa vs frs
                      (I - pcs(compxE\<^sub>2 e\<^sub>1 pc (size vs)))" by fact
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note eval\<^sub>1
       also have "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,?pc\<^sub>2)#frs)"
         using val Seq\<^sub>1.prems IH\<^sub>2 by fastforce
       finally show ?trans by(simp add:add.assoc)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)")
     proof
       assume throw: ?throw
       then obtain pc\<^sub>2 where
         pc\<^sub>2: "?pc\<^sub>1+1 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>2 \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 e\<^sub>2 (?pc\<^sub>1+1) (size vs))" and
         eval\<^sub>2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 vs ls\<^sub>2 pc\<^sub>2 frs"
         using IH\<^sub>2 Seq\<^sub>1.prems by fastforce
       have "?H pc\<^sub>2" using pc\<^sub>2 jvm_trans[OF eval\<^sub>1 eval\<^sub>2] by auto
       thus "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     qed
   qed
 next
   case SeqThrow\<^sub>1 thus ?case by fastforce
 next
   case (CondT\<^sub>1 e h\<^sub>0 ls\<^sub>0 h\<^sub>1 ls\<^sub>1 e\<^sub>1 e' h\<^sub>2 ls\<^sub>2 e\<^sub>2)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs,ls\<^sub>1,C,M,?pc\<^sub>1+1)#frs)"
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h\<^sub>1,(Bool(True)#vs,ls\<^sub>1,C,M,?pc\<^sub>1)#frs)"
     using CondT\<^sub>1 by (fastforce simp add: Int_Un_distrib)
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1" using CondT\<^sub>1 by auto
   finally have eval\<^sub>1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1".
   let ?pc\<^sub>1' = "?pc\<^sub>1 + 1 + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>2' = "?pc\<^sub>1' + 1 + length(compE\<^sub>2 e\<^sub>2)"
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note eval\<^sub>1
       also have "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,?pc\<^sub>1')#frs)"
         using val CondT\<^sub>1 by(fastforce simp:Int_Un_distrib)
       also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,?pc\<^sub>2')#frs)"
         using CondT\<^sub>1 by(auto simp:add.assoc)
       finally show ?trans by(simp add:add.assoc)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)")
     proof
       let ?d = "size vs"
       let ?I = "I - pcs(compxE\<^sub>2 e pc ?d) - pcs(compxE\<^sub>2 e\<^sub>2 (?pc\<^sub>1'+1) ?d)"
       assume throw: ?throw
       moreover
       have "PROP ?P e\<^sub>1 h\<^sub>1 ls\<^sub>1 e' h\<^sub>2 ls\<^sub>2 C M (?pc\<^sub>1+1) v xa vs frs ?I" by fact
       ultimately obtain pc\<^sub>2 where
         pc\<^sub>2: "?pc\<^sub>1+1 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>1' \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 e\<^sub>1 (?pc\<^sub>1+1) (size vs))" and
         eval\<^sub>2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 vs ls\<^sub>2 pc\<^sub>2 frs"
         using CondT\<^sub>1.prems by (fastforce simp:Int_Un_distrib)
       have "?H pc\<^sub>2" using pc\<^sub>2 jvm_trans[OF eval\<^sub>1 eval\<^sub>2] by auto
       thus "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     qed
   qed
 next
   case (CondF\<^sub>1 e h\<^sub>0 ls\<^sub>0 h\<^sub>1 ls\<^sub>1 e\<^sub>2 e' h\<^sub>2 ls\<^sub>2 e\<^sub>1)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + 1 + length(compE\<^sub>2 e\<^sub>1)+ 1"
   let ?pc\<^sub>2' = "?pc\<^sub>2 + length(compE\<^sub>2 e\<^sub>2)"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs,ls\<^sub>1,C,M,?pc\<^sub>2)#frs)"
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h\<^sub>1,(Bool(False)#vs,ls\<^sub>1,C,M,?pc\<^sub>1)#frs)"
     using CondF\<^sub>1 by (fastforce simp add: Int_Un_distrib)
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1" using CondF\<^sub>1 by auto
   finally have eval\<^sub>1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1".
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note eval\<^sub>1
       also have "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,?pc\<^sub>2')#frs)"
         using val CondF\<^sub>1 by(fastforce simp:Int_Un_distrib)
       finally show ?trans by(simp add:add.assoc)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)")
     proof
       let ?d = "size vs"
       let ?I = "I - pcs(compxE\<^sub>2 e pc ?d) - pcs(compxE\<^sub>2 e\<^sub>1 (?pc\<^sub>1+1) ?d)"
       assume throw: ?throw
       moreover
       have "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 e' h\<^sub>2 ls\<^sub>2 C M ?pc\<^sub>2 v xa vs frs ?I" by fact
       ultimately obtain pc\<^sub>2 where
         pc\<^sub>2: "?pc\<^sub>2 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>2' \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 e\<^sub>2 ?pc\<^sub>2 ?d)" and
         eval\<^sub>2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 vs ls\<^sub>2 pc\<^sub>2 frs"
         using CondF\<^sub>1.prems by(fastforce simp:Int_Un_distrib)
       have "?H pc\<^sub>2" using pc\<^sub>2 jvm_trans[OF eval\<^sub>1 eval\<^sub>2] by auto
       thus "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     qed
   qed
 next
   case (CondThrow\<^sub>1 e h\<^sub>0 ls\<^sub>0 f h\<^sub>1 ls\<^sub>1 e\<^sub>1 e\<^sub>2)
   let ?d = "size vs"
   let ?xt\<^sub>1 = "compxE\<^sub>2 e\<^sub>1 (pc+size(compE\<^sub>2 e)+1) ?d"
   let ?xt\<^sub>2 = "compxE\<^sub>2 e\<^sub>2 (pc+size(compE\<^sub>2 e)+size(compE\<^sub>2 e\<^sub>1)+2) ?d"
   let ?I = "I - (pcs ?xt\<^sub>1 \<union> pcs ?xt\<^sub>2)"
   have "pcs(compxE\<^sub>2 e pc ?d) \<inter> pcs(?xt\<^sub>1 @ ?xt\<^sub>2) = {}"
     using CondThrow\<^sub>1.prems by (simp add:Int_Un_distrib)
   moreover have "PROP ?P e h\<^sub>0 ls\<^sub>0 (throw f) h\<^sub>1 ls\<^sub>1 C M pc v xa vs frs ?I" by fact
   ultimately show ?case using CondThrow\<^sub>1.prems by fastforce
 next
   case (WhileF\<^sub>1 e h\<^sub>0 ls\<^sub>0 h\<^sub>1 ls\<^sub>1 c)
   let ?pc = "pc + length(compE\<^sub>2 e)"
   let ?pc' = "?pc + length(compE\<^sub>2 c) + 3"
   have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
             (None,h\<^sub>1,(Bool False#vs,ls\<^sub>1,C,M,?pc)#frs)"
     using WhileF\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(vs,ls\<^sub>1,C,M,?pc')#frs)"
     using WhileF\<^sub>1 by (auto simp:add.assoc)
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(Unit#vs,ls\<^sub>1,C,M,?pc'+1)#frs)"
     using WhileF\<^sub>1.prems by (auto simp:eval_nat_numeral)
   finally show ?case by (simp add:add.assoc eval_nat_numeral)
 next
   case (WhileT\<^sub>1 e h\<^sub>0 ls\<^sub>0 h\<^sub>1 ls\<^sub>1 c v\<^sub>1 h\<^sub>2 ls\<^sub>2 e\<^sub>3 h\<^sub>3 ls\<^sub>3)
   let ?pc = "pc + length(compE\<^sub>2 e)"
   let ?pc' = "?pc + length(compE\<^sub>2 c) + 1"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs)"
   let ?\<sigma>\<^sub>2 = "(None,h\<^sub>2,(vs,ls\<^sub>2,C,M,pc)#frs)"
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h\<^sub>1,(Bool True#vs,ls\<^sub>1,C,M,?pc)#frs)"
     using WhileT\<^sub>1 by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(vs,ls\<^sub>1,C,M,?pc+1)#frs)"
     using WhileT\<^sub>1.prems by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(v\<^sub>1#vs,ls\<^sub>2,C,M,?pc')#frs)"
     using WhileT\<^sub>1 by(fastforce)
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>2" using WhileT\<^sub>1.prems by auto
   finally have 1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>2".
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note 1
       also have "P \<turnstile> ?\<sigma>\<^sub>2 -jvm\<rightarrow> (None,h\<^sub>3,(v#vs,ls\<^sub>3,C,M,?pc'+3)#frs)"
         using val WhileT\<^sub>1 by (auto simp add:add.assoc eval_nat_numeral)
       finally show ?trans by(simp add:add.assoc eval_nat_numeral)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)")
     proof
       assume throw: ?throw
       moreover
       have "PROP ?P (while (e) c) h\<^sub>2 ls\<^sub>2 e\<^sub>3 h\<^sub>3 ls\<^sub>3 C M pc v xa vs frs I" by fact
       ultimately obtain pc\<^sub>2 where
         pc\<^sub>2: "pc \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc'+3 \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>3 xa (compxE\<^sub>2 (while (e) c) pc (size vs))" and
         2: "P \<turnstile> ?\<sigma>\<^sub>2 -jvm\<rightarrow> handle P C M xa h\<^sub>3 vs ls\<^sub>3 pc\<^sub>2 frs"
         using WhileT\<^sub>1.prems by (auto simp:add.assoc eval_nat_numeral)
       have "?H pc\<^sub>2" using pc\<^sub>2 jvm_trans[OF 1 2] by auto
       thus "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     qed
   qed
 next
   case WhileCondThrow\<^sub>1 thus ?case by fastforce
 next
   case (WhileBodyThrow\<^sub>1 e h\<^sub>0 ls\<^sub>0 h\<^sub>1 ls\<^sub>1 c e' h\<^sub>2 ls\<^sub>2)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs,ls\<^sub>1,C,M,?pc\<^sub>1+1)#frs)"
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h\<^sub>1,(Bool(True)#vs,ls\<^sub>1,C,M,?pc\<^sub>1)#frs)"
     using WhileBodyThrow\<^sub>1 by (fastforce simp add: Int_Un_distrib)
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1" using  WhileBodyThrow\<^sub>1 by auto
   finally have eval\<^sub>1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1".
   let ?pc\<^sub>1' = "?pc\<^sub>1 + 1 + length(compE\<^sub>2 c)"
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm by simp
   next
     show ?Err (is "?throw \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)")
     proof
       assume throw: ?throw
       moreover
       have "PROP ?P c h\<^sub>1 ls\<^sub>1 (throw e') h\<^sub>2 ls\<^sub>2 C M (?pc\<^sub>1+1) v xa vs frs
                     (I - pcs (compxE\<^sub>2 e pc (size vs)))" by fact
       ultimately obtain pc\<^sub>2 where
         pc\<^sub>2: "?pc\<^sub>1+1 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>1' \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 c (?pc\<^sub>1+1) (size vs))" and
         eval\<^sub>2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 vs ls\<^sub>2 pc\<^sub>2 frs"
         using WhileBodyThrow\<^sub>1.prems by (fastforce simp:Int_Un_distrib)
       have "?H pc\<^sub>2" using pc\<^sub>2 jvm_trans[OF eval\<^sub>1 eval\<^sub>2] by auto
       thus "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     qed
   qed
 next
   case (Throw\<^sub>1 e h\<^sub>0 ls\<^sub>0 a h\<^sub>1 ls\<^sub>1)
   let ?pc = "pc + size(compE\<^sub>2 e)"
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm by simp
   next
     show ?Err (is "?throw \<longrightarrow> (\<exists>pc\<^sub>1. ?H pc\<^sub>1)")
     proof
       assume ?throw
       hence "P \<turnstile> (None, h\<^sub>0, (vs, ls\<^sub>0, C, M, pc) # frs) -jvm\<rightarrow>
                  (None, h\<^sub>1, (Addr xa#vs, ls\<^sub>1, C, M, ?pc) # frs)"
         using Throw\<^sub>1 by fastforce
       also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M xa h\<^sub>1 (Addr xa#vs) ls\<^sub>1 ?pc frs"
         using Throw\<^sub>1.prems by(auto simp add:handle_def)
       also have "handle P C M xa h\<^sub>1 (Addr xa#vs) ls\<^sub>1 ?pc frs =
                  handle P C M xa h\<^sub>1 vs ls\<^sub>1 ?pc frs"
         using Throw\<^sub>1.prems by(auto simp add:handle_Cons)
       finally have "?H ?pc" by simp
       thus "\<exists>pc\<^sub>1. ?H pc\<^sub>1" by iprover
     qed
   qed
 next
   case (ThrowNull\<^sub>1 e h\<^sub>0 ls\<^sub>0 h\<^sub>1 ls\<^sub>1)
   let ?pc = "pc + size(compE\<^sub>2 e)"
   let ?xa = "addr_of_sys_xcpt NullPointer"
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm by simp
   next
     show ?Err (is "?throw \<longrightarrow> (\<exists>pc\<^sub>1. ?H pc\<^sub>1)")
     proof
       assume throw: ?throw
       have "P \<turnstile> (None, h\<^sub>0, (vs, ls\<^sub>0, C, M, pc) # frs) -jvm\<rightarrow>
                  (None, h\<^sub>1, (Null#vs, ls\<^sub>1, C, M, ?pc) # frs)"
         using ThrowNull\<^sub>1 by fastforce
       also have "P \<turnstile> \<dots> -jvm\<rightarrow>  handle P C M ?xa h\<^sub>1 (Null#vs) ls\<^sub>1 ?pc frs"
         using ThrowNull\<^sub>1.prems by(auto simp add:handle_def)
       also have "handle P C M ?xa h\<^sub>1 (Null#vs) ls\<^sub>1 ?pc frs =
                  handle P C M ?xa h\<^sub>1 vs ls\<^sub>1 ?pc frs"
         using ThrowNull\<^sub>1.prems by(auto simp add:handle_Cons)
       finally have "?H ?pc" using throw by simp
       thus "\<exists>pc\<^sub>1. ?H pc\<^sub>1" by iprover
     qed
   qed
 next
   case ThrowThrow\<^sub>1 thus ?case by fastforce
 next
   case (Try\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 v\<^sub>1 h\<^sub>1 ls\<^sub>1 Ci i e\<^sub>2)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>1' = "?pc\<^sub>1 + 2 + length(compE\<^sub>2 e\<^sub>2)"
   have "P,C,M \<rhd> compxE\<^sub>2 (try e\<^sub>1 catch(Ci i) e\<^sub>2) pc (size vs) / I,size vs" by fact
   hence "P,C,M \<rhd> compxE\<^sub>2 e\<^sub>1 pc (size vs) /
                  {pc..<pc + length (compE\<^sub>2 e\<^sub>1)},size vs"
     using Try\<^sub>1.prems by (fastforce simp:beforex_def split:if_split_asm)
   hence "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs) -jvm\<rightarrow>
              (None,h\<^sub>1,(v\<^sub>1#vs,ls\<^sub>1,C,M,?pc\<^sub>1)#frs)" using Try\<^sub>1 by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(v\<^sub>1#vs,ls\<^sub>1,C,M,?pc\<^sub>1')#frs)"
     using Try\<^sub>1.prems by auto
   finally show ?case by (auto simp:add.assoc)
 next
   case (TryCatch\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 a h\<^sub>1 ls\<^sub>1 D fs Ci i e\<^sub>2 e\<^sub>2' h\<^sub>2 ls\<^sub>2)
   let ?e = "try e\<^sub>1 catch(Ci i) e\<^sub>2"
   let ?xt = "compxE\<^sub>2 ?e pc (size vs)"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs)"
   let ?ls\<^sub>1 = "ls\<^sub>1[i := Addr a]"
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>1' = "?pc\<^sub>1 + 2"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs,?ls\<^sub>1,C,M, ?pc\<^sub>1') # frs)"
   have I: "{pc..<pc + length (compE\<^sub>2 (try e\<^sub>1 catch(Ci i) e\<^sub>2))} \<subseteq> I"
    and beforex: "P,C,M \<rhd> ?xt/I,size vs" by fact+
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h\<^sub>1,((Addr a)#vs,ls\<^sub>1,C,M, ?pc\<^sub>1+1) # frs)"
   proof -
     have "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 (Throw a) h\<^sub>1 ls\<^sub>1 C M pc w a vs frs {pc..<pc + length (compE\<^sub>2 e\<^sub>1)}"
       by fact
     moreover have "P,C,M \<rhd> compxE\<^sub>2 e\<^sub>1 pc (size vs)/{pc..<?pc\<^sub>1},size vs"
       using beforex I pcs_subset by(force elim!: beforex_appendD1)
     ultimately have
       "\<exists>pc\<^sub>1. pc \<le> pc\<^sub>1 \<and> pc\<^sub>1 < ?pc\<^sub>1 \<and>
              \<not> caught P pc\<^sub>1 h\<^sub>1 a (compxE\<^sub>2 e\<^sub>1 pc (size vs)) \<and>
              P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> handle P C M a h\<^sub>1 vs ls\<^sub>1 pc\<^sub>1 frs"
       using  TryCatch\<^sub>1.prems by auto
     then obtain pc\<^sub>1 where
       pc\<^sub>1_in_e\<^sub>1: "pc \<le> pc\<^sub>1" "pc\<^sub>1 < ?pc\<^sub>1" and
       pc\<^sub>1_not_caught: "\<not> caught P pc\<^sub>1 h\<^sub>1 a (compxE\<^sub>2 e\<^sub>1 pc (size vs))" and
       0: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> handle P C M a h\<^sub>1 vs ls\<^sub>1 pc\<^sub>1 frs" by iprover
     from beforex obtain xt\<^sub>0 xt\<^sub>1
       where ex_tab: "ex_table_of P C M = xt\<^sub>0 @ ?xt @ xt\<^sub>1"
       and disj: "pcs xt\<^sub>0 \<inter> I = {}" by(auto simp:beforex_def)
     have hp: "h\<^sub>1 a = Some (D, fs)" "P\<^sub>1 \<turnstile> D \<preceq>\<^sup>* Ci" by fact+
     have "pc\<^sub>1 \<notin> pcs xt\<^sub>0" using pc\<^sub>1_in_e\<^sub>1 I disj by auto
     with pc\<^sub>1_in_e\<^sub>1 pc\<^sub>1_not_caught hp
     show ?thesis using ex_tab 0 by(simp add:handle_def matches_ex_entry_def)
   qed
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1" using TryCatch\<^sub>1 by auto
   finally have 1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1" .
   let ?pc\<^sub>2 = "?pc\<^sub>1' + length(compE\<^sub>2 e\<^sub>2)"
   let ?I\<^sub>2 = "{?pc\<^sub>1' ..< ?pc\<^sub>2}"
   have "P,C,M \<rhd> compxE\<^sub>2 ?e pc (size vs) / I,size vs" by fact
   hence beforex\<^sub>2: "P,C,M \<rhd> compxE\<^sub>2 e\<^sub>2 ?pc\<^sub>1' (size vs) / ?I\<^sub>2, size vs"
     using I pcs_subset[of _ ?pc\<^sub>1'] by(auto elim!:beforex_appendD2)
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ?ls\<^sub>1 e\<^sub>2' h\<^sub>2 ls\<^sub>2 C M ?pc\<^sub>1' v xa vs frs ?I\<^sub>2" by fact
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note 1 also have "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,?pc\<^sub>2)#frs)"
         using val beforex\<^sub>2 IH\<^sub>2 TryCatch\<^sub>1.prems by auto
       finally show ?trans by(simp add:add.assoc)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)")
     proof
       assume throw: ?throw
       then obtain pc\<^sub>2 where
         pc\<^sub>2: "?pc\<^sub>1+2 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>2 \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 e\<^sub>2 ?pc\<^sub>1' (size vs))" and
         2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 vs ls\<^sub>2 pc\<^sub>2 frs"
         using IH\<^sub>2 beforex\<^sub>2 TryCatch\<^sub>1.prems by auto
       have "?H pc\<^sub>2" using pc\<^sub>2 jvm_trans[OF 1 2]
         by (simp add:match_ex_entry) (fastforce)
       thus "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     qed
   qed
 next
   case (TryThrow\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 a h\<^sub>1 ls\<^sub>1 D fs Ci i e\<^sub>2)
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs)"
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?e = "try e\<^sub>1 catch(Ci i) e\<^sub>2"
   let ?xt = "compxE\<^sub>2 ?e pc (size vs)"
   have I: "{pc..<pc + length (compE\<^sub>2 (try e\<^sub>1 catch(Ci i) e\<^sub>2))} \<subseteq> I"
    and beforex: "P,C,M \<rhd> ?xt/I,size vs" by fact+
   have "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 (Throw a) h\<^sub>1 ls\<^sub>1 C M pc w a vs frs {pc..<pc + length (compE\<^sub>2 e\<^sub>1)}" by fact
   moreover have "P,C,M \<rhd> compxE\<^sub>2 e\<^sub>1 pc (size vs)/{pc..<?pc\<^sub>1},size vs"
     using beforex I pcs_subset by(force elim!: beforex_appendD1)
     ultimately have
       "\<exists>pc\<^sub>1. pc \<le> pc\<^sub>1 \<and> pc\<^sub>1 < ?pc\<^sub>1 \<and>
              \<not> caught P pc\<^sub>1 h\<^sub>1 a (compxE\<^sub>2 e\<^sub>1 pc (size vs)) \<and>
              P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> handle P C M a h\<^sub>1 vs ls\<^sub>1 pc\<^sub>1 frs"
       using TryThrow\<^sub>1.prems by auto
     then obtain pc\<^sub>1 where
       pc\<^sub>1_in_e\<^sub>1: "pc \<le> pc\<^sub>1" "pc\<^sub>1 < ?pc\<^sub>1" and
       pc\<^sub>1_not_caught: "\<not> caught P pc\<^sub>1 h\<^sub>1 a (compxE\<^sub>2 e\<^sub>1 pc (size vs))" and
       0: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> handle P C M a h\<^sub>1 vs ls\<^sub>1 pc\<^sub>1 frs" by iprover
   show ?case (is "?N \<and> (?eq \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2))")
   proof
     show ?N by simp
   next
     { assume ?eq
       with TryThrow\<^sub>1 pc\<^sub>1_in_e\<^sub>1 pc\<^sub>1_not_caught 0
       have "?H pc\<^sub>1" by (simp add:match_ex_entry) auto
       hence "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     }
     thus "?eq \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)" by iprover
   qed
 next
   case Nil\<^sub>1 thus ?case by simp
 next
   case (Cons\<^sub>1 e h\<^sub>0 ls\<^sub>0 v h\<^sub>1 ls\<^sub>1 es fs h\<^sub>2 ls\<^sub>2)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc)#frs)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,?pc\<^sub>1)#frs)"
   have 1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1" using Cons\<^sub>1 by fastforce
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compEs\<^sub>2 es)"
   have IHs: "PROP ?Ps es h\<^sub>1 ls\<^sub>1 fs h\<^sub>2 ls\<^sub>2 C M ?pc\<^sub>1 (tl ws) xa es' (v#vs) frs
     (I - pcs (compxE\<^sub>2 e pc (length vs)))" by fact
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note 1
       also have "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> (None,h\<^sub>2,(rev(ws) @ vs,ls\<^sub>2,C,M,?pc\<^sub>2)#frs)"
         using val IHs Cons\<^sub>1.prems by fastforce
       finally show ?trans by(simp add:add.assoc)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)")
     proof
       assume throw: ?throw
       then obtain pc\<^sub>2 where
         pc\<^sub>2: "?pc\<^sub>1 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>2 \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxEs\<^sub>2 es ?pc\<^sub>1 (size vs + 1))" and
         2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (v#vs) ls\<^sub>2 pc\<^sub>2 frs"
         using IHs Cons\<^sub>1.prems
         by(fastforce simp:Cons_eq_append_conv neq_Nil_conv)
       have "?H pc\<^sub>2" using Cons\<^sub>1.prems pc\<^sub>2 jvm_trans[OF 1 2]
         by (auto simp add: handle_Cons)
       thus "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     qed
   qed
 next
   case ConsThrow\<^sub>1 thus ?case by (fastforce simp:Cons_eq_append_conv)
 qed
 (*>*)
 
 
 (*FIXME move! *)
 lemma atLeast0AtMost[simp]: "{0::nat..n} = {..n}"
 by auto
 
 lemma atLeast0LessThan[simp]: "{0::nat..<n} = {..<n}"
 by auto
 
 fun exception :: "'a exp \<Rightarrow> addr option" where
   "exception (Throw a) = Some a"
 | "exception e = None"
 
 
 lemma comp\<^sub>2_correct:
 assumes "method": "P\<^sub>1 \<turnstile> C sees M:Ts\<rightarrow>T = body in C"
     and eval:   "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>body,(h,ls)\<rangle> \<Rightarrow> \<langle>e',(h',ls')\<rangle>"
 shows "compP\<^sub>2 P\<^sub>1 \<turnstile> (None,h,[([],ls,C,M,0)]) -jvm\<rightarrow> (exception e',h',[])"
 (*<*)
       (is "_ \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1")
 proof -
   let ?P = "compP\<^sub>2 P\<^sub>1"
   have code: "?P,C,M,0 \<rhd> compE\<^sub>2 body" using beforeM[OF "method"] by auto
   have xtab: "?P,C,M \<rhd> compxE\<^sub>2 body 0 (size[])/{..<size(compE\<^sub>2 body)},size[]"
     using beforexM[OF "method"] by auto
   \<comment> \<open>Distinguish if e' is a value or an exception\<close>
   { fix v assume [simp]: "e' = Val v"
     have "?P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h',[([v],ls',C,M,size(compE\<^sub>2 body))])"
       using Jcc[OF eval code xtab] by auto
     also have "?P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1" using beforeM[OF "method"] by auto
     finally have ?thesis .
   }
   moreover
   { fix a assume [simp]: "e' = Throw a"
     obtain pc where pc: "0 \<le> pc \<and> pc < size(compE\<^sub>2 body) \<and>
           \<not> caught ?P pc h' a (compxE\<^sub>2 body 0 0)"
     and 1: "?P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> handle ?P C M a h' [] ls' pc []"
       using Jcc[OF eval code xtab] by fastforce
     from pc have "handle ?P C M a h' [] ls' pc [] = ?\<sigma>\<^sub>1" using xtab "method"
       by(auto simp:handle_def compMb\<^sub>2_def)
     with 1 have ?thesis by simp
   } 
   ultimately show ?thesis using eval\<^sub>1_final[OF eval] by(auto simp:final_def)
 qed
 (*>*)
 
 end
diff --git a/thys/Jinja/Compiler/J1.thy b/thys/Jinja/Compiler/J1.thy
--- a/thys/Jinja/Compiler/J1.thy
+++ b/thys/Jinja/Compiler/J1.thy
@@ -1,225 +1,221 @@
 (*  Title:      Jinja/Compiler/J1.thy
     Author:     Tobias Nipkow
     Copyright   2003 Technische Universitaet Muenchen
 *)
 
 chapter \<open>Compilation \label{cha:comp}\<close>
 
 section \<open>An Intermediate Language\<close>
 
 theory J1 imports "../J/BigStep" begin
 
 type_synonym expr\<^sub>1 = "nat exp"
 type_synonym J\<^sub>1_prog = "expr\<^sub>1 prog"
 type_synonym state\<^sub>1 = "heap \<times> (val list)"
 
 primrec
   max_vars :: "'a exp \<Rightarrow> nat"
   and max_varss :: "'a exp list \<Rightarrow> nat"
 where
   "max_vars(new C) = 0"
 | "max_vars(Cast C e) = max_vars e"
 | "max_vars(Val v) = 0"
 | "max_vars(e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2) = max (max_vars e\<^sub>1) (max_vars e\<^sub>2)"
 | "max_vars(Var V) = 0"
 | "max_vars(V:=e) = max_vars e"
 | "max_vars(e\<bullet>F{D}) = max_vars e"
 | "max_vars(FAss e\<^sub>1 F D e\<^sub>2) = max (max_vars e\<^sub>1) (max_vars e\<^sub>2)"
 | "max_vars(e\<bullet>M(es)) = max (max_vars e) (max_varss es)"
 | "max_vars({V:T; e}) = max_vars e + 1"
 | "max_vars(e\<^sub>1;;e\<^sub>2) = max (max_vars e\<^sub>1) (max_vars e\<^sub>2)"
 | "max_vars(if (e) e\<^sub>1 else e\<^sub>2) =
    max (max_vars e) (max (max_vars e\<^sub>1) (max_vars e\<^sub>2))"
 | "max_vars(while (b) e) = max (max_vars b) (max_vars e)"
 | "max_vars(throw e) = max_vars e"
 | "max_vars(try e\<^sub>1 catch(C V) e\<^sub>2) = max (max_vars e\<^sub>1) (max_vars e\<^sub>2 + 1)"
 
 | "max_varss [] = 0"
 | "max_varss (e#es) = max (max_vars e) (max_varss es)"
 
 inductive
   eval\<^sub>1 :: "J\<^sub>1_prog \<Rightarrow> expr\<^sub>1 \<Rightarrow> state\<^sub>1 \<Rightarrow> expr\<^sub>1 \<Rightarrow> state\<^sub>1 \<Rightarrow> bool"
           ("_ \<turnstile>\<^sub>1 ((1\<langle>_,/_\<rangle>) \<Rightarrow>/ (1\<langle>_,/_\<rangle>))" [51,0,0,0,0] 81)
   and evals\<^sub>1 :: "J\<^sub>1_prog \<Rightarrow> expr\<^sub>1 list \<Rightarrow> state\<^sub>1 \<Rightarrow> expr\<^sub>1 list \<Rightarrow> state\<^sub>1 \<Rightarrow> bool"
            ("_ \<turnstile>\<^sub>1 ((1\<langle>_,/_\<rangle>) [\<Rightarrow>]/ (1\<langle>_,/_\<rangle>))" [51,0,0,0,0] 81)
   for P :: J\<^sub>1_prog
 where
 
   New\<^sub>1:
   "\<lbrakk> new_Addr h = Some a; P \<turnstile> C has_fields FDTs; h' = h(a\<mapsto>(C,init_fields FDTs)) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>new C,(h,l)\<rangle> \<Rightarrow> \<langle>addr a,(h',l)\<rangle>"
 | NewFail\<^sub>1:
   "new_Addr h = None \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>new C, (h,l)\<rangle> \<Rightarrow> \<langle>THROW OutOfMemory,(h,l)\<rangle>"
 
 | Cast\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,(h,l)\<rangle>; h a = Some(D,fs); P \<turnstile> D \<preceq>\<^sup>* C \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>Cast C e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,(h,l)\<rangle>"
 | CastNull\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>null,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>Cast C e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>null,s\<^sub>1\<rangle>"
 | CastFail\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,(h,l)\<rangle>; h a = Some(D,fs); \<not> P \<turnstile> D \<preceq>\<^sup>* C \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>Cast C e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW ClassCast,(h,l)\<rangle>"
 | CastThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>Cast C e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 
 | Val\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>Val v,s\<rangle> \<Rightarrow> \<langle>Val v,s\<rangle>"
 
 | BinOp\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v\<^sub>1,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>Val v\<^sub>2,s\<^sub>2\<rangle>; binop(bop,v\<^sub>1,v\<^sub>2) = Some v \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,s\<^sub>2\<rangle>"
 | BinOpThrow\<^sub>1\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2, s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e,s\<^sub>1\<rangle>"
 | BinOpThrow\<^sub>2\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v\<^sub>1,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>throw e,s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e,s\<^sub>2\<rangle>"
 
 | Var\<^sub>1:
   "\<lbrakk> ls!i = v; i < size ls \<rbrakk> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>Var i,(h,ls)\<rangle> \<Rightarrow> \<langle>Val v,(h,ls)\<rangle>"
 
 | LAss\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,(h,ls)\<rangle>; i < size ls; ls' = ls[i := v] \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>i:= e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>unit,(h,ls')\<rangle>"
 | LAssThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>i:= e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 
 | FAcc\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,(h,ls)\<rangle>; h a = Some(C,fs); fs(F,D) = Some v \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<bullet>F{D},s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,(h,ls)\<rangle>"
 | FAccNull\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>null,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e\<bullet>F{D},s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW NullPointer,s\<^sub>1\<rangle>"
 | FAccThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e\<bullet>F{D},s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 
 | FAss\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>Val v,(h\<^sub>2,l\<^sub>2)\<rangle>;
     h\<^sub>2 a = Some(C,fs); fs' = fs((F,D)\<mapsto>v); h\<^sub>2' = h\<^sub>2(a\<mapsto>(C,fs')) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1\<bullet>F{D}:= e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>unit,(h\<^sub>2',l\<^sub>2)\<rangle>"
 | FAssNull\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>null,s\<^sub>1\<rangle>;  P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>Val v,s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1\<bullet>F{D}:= e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW NullPointer,s\<^sub>2\<rangle>"
 | FAssThrow\<^sub>1\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e\<^sub>1\<bullet>F{D}:= e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 | FAssThrow\<^sub>2\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1\<bullet>F{D}:= e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>2\<rangle>"
 
 | CallObjThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e\<bullet>M(es),s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 | CallNull\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>null,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>es,s\<^sub>1\<rangle> [\<Rightarrow>] \<langle>map Val vs,s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<bullet>M(es),s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW NullPointer,s\<^sub>2\<rangle>"
 | Call\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>es,s\<^sub>1\<rangle> [\<Rightarrow>] \<langle>map Val vs,(h\<^sub>2,ls\<^sub>2)\<rangle>;
     h\<^sub>2 a = Some(C,fs); P \<turnstile> C sees M:Ts\<rightarrow>T = body in D;
     size vs = size Ts; ls\<^sub>2' = (Addr a) # vs @ replicate (max_vars body) undefined;
     P \<turnstile>\<^sub>1 \<langle>body,(h\<^sub>2,ls\<^sub>2')\<rangle> \<Rightarrow> \<langle>e',(h\<^sub>3,ls\<^sub>3)\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<bullet>M(es),s\<^sub>0\<rangle> \<Rightarrow> \<langle>e',(h\<^sub>3,ls\<^sub>2)\<rangle>"
 | CallParamsThrow\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>es,s\<^sub>1\<rangle> [\<Rightarrow>] \<langle>es',s\<^sub>2\<rangle>;
      es' = map Val vs @ throw ex # es\<^sub>2 \<rbrakk>
    \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<bullet>M(es),s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw ex,s\<^sub>2\<rangle>"
 
 | Block\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e',s\<^sub>1\<rangle> \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>Block i T e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e',s\<^sub>1\<rangle>"
 
 | Seq\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>0,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>1\<rangle> \<Rightarrow> \<langle>e\<^sub>2,s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<^sub>0;;e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e\<^sub>2,s\<^sub>2\<rangle>"
 | SeqThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e\<^sub>0,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e\<^sub>0;;e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e,s\<^sub>1\<rangle>"
 
 | CondT\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>true,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>1\<rangle> \<Rightarrow> \<langle>e',s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>if (e) e\<^sub>1 else e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e',s\<^sub>2\<rangle>"
 | CondF\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>false,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>e',s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>if (e) e\<^sub>1 else e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e',s\<^sub>2\<rangle>"
 | CondThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>if (e) e\<^sub>1 else e\<^sub>2, s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 
 | WhileF\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>false,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>while (e) c,s\<^sub>0\<rangle> \<Rightarrow> \<langle>unit,s\<^sub>1\<rangle>"
 | WhileT\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>true,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>c,s\<^sub>1\<rangle> \<Rightarrow> \<langle>Val v\<^sub>1,s\<^sub>2\<rangle>;
     P \<turnstile>\<^sub>1 \<langle>while (e) c,s\<^sub>2\<rangle> \<Rightarrow> \<langle>e\<^sub>3,s\<^sub>3\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>while (e) c,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e\<^sub>3,s\<^sub>3\<rangle>"
 | WhileCondThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>while (e) c,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 | WhileBodyThrow\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>true,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>c,s\<^sub>1\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>2\<rangle>\<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>while (e) c,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>2\<rangle>"
 
 | Throw\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>throw e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Throw a,s\<^sub>1\<rangle>"
 | ThrowNull\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>null,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>throw e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW NullPointer,s\<^sub>1\<rangle>"
 | ThrowThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>throw e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 
 | Try\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v\<^sub>1,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>try e\<^sub>1 catch(C i) e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v\<^sub>1,s\<^sub>1\<rangle>"
 | TryCatch\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Throw a,(h\<^sub>1,ls\<^sub>1)\<rangle>;
     h\<^sub>1 a = Some(D,fs); P \<turnstile> D \<preceq>\<^sup>* C; i < length ls\<^sub>1;
     P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,(h\<^sub>1,ls\<^sub>1[i:=Addr a])\<rangle> \<Rightarrow> \<langle>e\<^sub>2',(h\<^sub>2,ls\<^sub>2)\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>try e\<^sub>1 catch(C i) e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e\<^sub>2',(h\<^sub>2,ls\<^sub>2)\<rangle>"
 | TryThrow\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Throw a,(h\<^sub>1,ls\<^sub>1)\<rangle>; h\<^sub>1 a = Some(D,fs); \<not> P \<turnstile> D \<preceq>\<^sup>* C \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>try e\<^sub>1 catch(C i) e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Throw a,(h\<^sub>1,ls\<^sub>1)\<rangle>"
 
 | Nil\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>[],s\<rangle> [\<Rightarrow>] \<langle>[],s\<rangle>"
 
 | Cons\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>es,s\<^sub>1\<rangle> [\<Rightarrow>] \<langle>es',s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e#es,s\<^sub>0\<rangle> [\<Rightarrow>] \<langle>Val v # es',s\<^sub>2\<rangle>"
 | ConsThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e#es,s\<^sub>0\<rangle> [\<Rightarrow>] \<langle>throw e' # es, s\<^sub>1\<rangle>"
 
 (*<*)
 lemmas eval\<^sub>1_evals\<^sub>1_induct = eval\<^sub>1_evals\<^sub>1.induct [split_format (complete)]
   and eval\<^sub>1_evals\<^sub>1_inducts = eval\<^sub>1_evals\<^sub>1.inducts [split_format (complete)]
 (*>*)
 
 lemma eval\<^sub>1_preserves_len:
   "P \<turnstile>\<^sub>1 \<langle>e\<^sub>0,(h\<^sub>0,ls\<^sub>0)\<rangle> \<Rightarrow> \<langle>e\<^sub>1,(h\<^sub>1,ls\<^sub>1)\<rangle> \<Longrightarrow> length ls\<^sub>0 = length ls\<^sub>1"
 and evals\<^sub>1_preserves_len:
   "P \<turnstile>\<^sub>1 \<langle>es\<^sub>0,(h\<^sub>0,ls\<^sub>0)\<rangle> [\<Rightarrow>] \<langle>es\<^sub>1,(h\<^sub>1,ls\<^sub>1)\<rangle> \<Longrightarrow> length ls\<^sub>0 = length ls\<^sub>1"
 (*<*)by (induct rule:eval\<^sub>1_evals\<^sub>1_inducts, simp_all)(*>*)
 
 
 lemma evals\<^sub>1_preserves_elen:
   "\<And>es' s s'. P \<turnstile>\<^sub>1 \<langle>es,s\<rangle> [\<Rightarrow>] \<langle>es',s'\<rangle> \<Longrightarrow> length es = length es'"
-(*<*)
-apply(induct es type:list)
-apply (auto elim:evals\<^sub>1.cases)
-done
-(*>*)
+(*<*)by(induct es type:list) (auto elim:evals\<^sub>1.cases)(*>*)
 
 
 lemma eval\<^sub>1_final: "P \<turnstile>\<^sub>1 \<langle>e,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle> \<Longrightarrow> final e'"
  and evals\<^sub>1_final: "P \<turnstile>\<^sub>1 \<langle>es,s\<rangle> [\<Rightarrow>] \<langle>es',s'\<rangle> \<Longrightarrow> finals es'"
 (*<*)by(induct rule:eval\<^sub>1_evals\<^sub>1.inducts, simp_all)(*>*)
 
 
 end
diff --git a/thys/Jinja/Compiler/J1WellForm.thy b/thys/Jinja/Compiler/J1WellForm.thy
--- a/thys/Jinja/Compiler/J1WellForm.thy
+++ b/thys/Jinja/Compiler/J1WellForm.thy
@@ -1,223 +1,209 @@
 (*  Title:      Jinja/Compiler/WellType1.thy
 
     Author:     Tobias Nipkow
     Copyright   2003 Technische Universitaet Muenchen
 *)
 
 section \<open>Well-Formedness of Intermediate Language\<close>
 
 theory J1WellForm
 imports "../J/JWellForm" J1
 begin
 
 subsection "Well-Typedness"
 
 type_synonym 
   env\<^sub>1  = "ty list"   \<comment> \<open>type environment indexed by variable number\<close>
 
 inductive
   WT\<^sub>1 :: "[J\<^sub>1_prog,env\<^sub>1, expr\<^sub>1     , ty     ] \<Rightarrow> bool"
          ("(_,_ \<turnstile>\<^sub>1/ _ :: _)"   [51,51,51]50)
   and WTs\<^sub>1 :: "[J\<^sub>1_prog,env\<^sub>1, expr\<^sub>1 list, ty list] \<Rightarrow> bool"
          ("(_,_ \<turnstile>\<^sub>1/ _ [::] _)" [51,51,51]50)
   for P :: J\<^sub>1_prog
 where
   
   WTNew\<^sub>1:
   "is_class P C  \<Longrightarrow>
   P,E \<turnstile>\<^sub>1 new C :: Class C"
 
 | WTCast\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e :: Class D;  is_class P C;  P \<turnstile> C \<preceq>\<^sup>* D \<or> P \<turnstile> D \<preceq>\<^sup>* C \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 Cast C e :: Class C"
 
 | WTVal\<^sub>1:
   "typeof v = Some T \<Longrightarrow>
   P,E \<turnstile>\<^sub>1 Val v :: T"
 
 | WTVar\<^sub>1:
   "\<lbrakk> E!i = T; i < size E \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 Var i :: T"
 
 | WTBinOp\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e\<^sub>1 :: T\<^sub>1;  P,E \<turnstile>\<^sub>1 e\<^sub>2 :: T\<^sub>2;
      case bop of Eq \<Rightarrow> (P \<turnstile> T\<^sub>1 \<le> T\<^sub>2 \<or> P \<turnstile> T\<^sub>2 \<le> T\<^sub>1) \<and> T = Boolean
                | Add \<Rightarrow> T\<^sub>1 = Integer \<and> T\<^sub>2 = Integer \<and> T = Integer \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2 :: T"
 
 | WTLAss\<^sub>1:
   "\<lbrakk> E!i = T;  i < size E; P,E \<turnstile>\<^sub>1 e :: T';  P \<turnstile> T' \<le> T \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 i:=e :: Void"
 
 | WTFAcc\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e :: Class C;  P \<turnstile> C sees F:T in D \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 e\<bullet>F{D} :: T"
 
 | WTFAss\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e\<^sub>1 :: Class C;  P \<turnstile> C sees F:T in D;  P,E \<turnstile>\<^sub>1 e\<^sub>2 :: T';  P \<turnstile> T' \<le> T \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 e\<^sub>1\<bullet>F{D} := e\<^sub>2 :: Void"
 
 | WTCall\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e :: Class C; P \<turnstile> C sees M:Ts' \<rightarrow> T = m in D;
     P,E \<turnstile>\<^sub>1 es [::] Ts;  P \<turnstile> Ts [\<le>] Ts' \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 e\<bullet>M(es) :: T"
 
 | WTBlock\<^sub>1:
   "\<lbrakk> is_type P T; P,E@[T] \<turnstile>\<^sub>1 e::T' \<rbrakk>
   \<Longrightarrow>  P,E \<turnstile>\<^sub>1 {i:T; e} :: T'"
 
 | WTSeq\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e\<^sub>1::T\<^sub>1;  P,E \<turnstile>\<^sub>1 e\<^sub>2::T\<^sub>2 \<rbrakk>
   \<Longrightarrow>  P,E \<turnstile>\<^sub>1 e\<^sub>1;;e\<^sub>2 :: T\<^sub>2"
 
 | WTCond\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e :: Boolean;  P,E \<turnstile>\<^sub>1 e\<^sub>1::T\<^sub>1;  P,E \<turnstile>\<^sub>1 e\<^sub>2::T\<^sub>2;
     P \<turnstile> T\<^sub>1 \<le> T\<^sub>2 \<or> P \<turnstile> T\<^sub>2 \<le> T\<^sub>1;  P \<turnstile> T\<^sub>1 \<le> T\<^sub>2 \<longrightarrow> T = T\<^sub>2; P \<turnstile> T\<^sub>2 \<le> T\<^sub>1 \<longrightarrow> T = T\<^sub>1 \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 if (e) e\<^sub>1 else e\<^sub>2 :: T"
 
 | WTWhile\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e :: Boolean;  P,E \<turnstile>\<^sub>1 c::T \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 while (e) c :: Void"
 
 | WTThrow\<^sub>1:
   "P,E \<turnstile>\<^sub>1 e :: Class C  \<Longrightarrow>
   P,E \<turnstile>\<^sub>1 throw e :: Void"
 
 | WTTry\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e\<^sub>1 :: T;  P,E@[Class C] \<turnstile>\<^sub>1 e\<^sub>2 :: T; is_class P C \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 try e\<^sub>1 catch(C i) e\<^sub>2 :: T"
 
 | WTNil\<^sub>1:
   "P,E \<turnstile>\<^sub>1 [] [::] []"
 
 | WTCons\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e :: T;  P,E \<turnstile>\<^sub>1 es [::] Ts \<rbrakk>
   \<Longrightarrow>  P,E \<turnstile>\<^sub>1 e#es [::] T#Ts"
 
 (*<*)
 declare  WT\<^sub>1_WTs\<^sub>1.intros[intro!]
 declare WTNil\<^sub>1[iff]
 
 lemmas WT\<^sub>1_WTs\<^sub>1_induct = WT\<^sub>1_WTs\<^sub>1.induct [split_format (complete)]
   and WT\<^sub>1_WTs\<^sub>1_inducts = WT\<^sub>1_WTs\<^sub>1.inducts [split_format (complete)]
 
 inductive_cases eee[elim!]:
   "P,E \<turnstile>\<^sub>1 Val v :: T"
   "P,E \<turnstile>\<^sub>1 Var i :: T"
   "P,E \<turnstile>\<^sub>1 Cast D e :: T"
   "P,E \<turnstile>\<^sub>1 i:=e :: T"
   "P,E \<turnstile>\<^sub>1 {i:U; e} :: T"
   "P,E \<turnstile>\<^sub>1 e\<^sub>1;;e\<^sub>2 :: T"
   "P,E \<turnstile>\<^sub>1 if (e) e\<^sub>1 else e\<^sub>2 :: T"
   "P,E \<turnstile>\<^sub>1 while (e) c :: T"
   "P,E \<turnstile>\<^sub>1 throw e :: T"
   "P,E \<turnstile>\<^sub>1 try e\<^sub>1 catch(C i) e\<^sub>2 :: T"
   "P,E \<turnstile>\<^sub>1 e\<bullet>F{D} :: T"
   "P,E \<turnstile>\<^sub>1 e\<^sub>1\<bullet>F{D}:=e\<^sub>2 :: T"
   "P,E \<turnstile>\<^sub>1 e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2 :: T"
   "P,E \<turnstile>\<^sub>1 new C :: T"
   "P,E \<turnstile>\<^sub>1 e\<bullet>M(es) :: T"
   "P,E \<turnstile>\<^sub>1 [] [::] Ts"
   "P,E \<turnstile>\<^sub>1 e#es [::] Ts"
 (*>*)
 
 lemma WTs\<^sub>1_same_size: "\<And>Ts. P,E \<turnstile>\<^sub>1 es [::] Ts \<Longrightarrow> size es = size Ts"
 (*<*)by (induct es type:list) auto(*>*)
 
 
 lemma WT\<^sub>1_unique:
   "P,E \<turnstile>\<^sub>1 e :: T\<^sub>1 \<Longrightarrow> (\<And>T\<^sub>2. P,E \<turnstile>\<^sub>1 e :: T\<^sub>2 \<Longrightarrow> T\<^sub>1 = T\<^sub>2)" and
   "P,E \<turnstile>\<^sub>1 es [::] Ts\<^sub>1 \<Longrightarrow> (\<And>Ts\<^sub>2. P,E \<turnstile>\<^sub>1 es [::] Ts\<^sub>2 \<Longrightarrow> Ts\<^sub>1 = Ts\<^sub>2)"
 (*<*)
-apply(induct rule:WT\<^sub>1_WTs\<^sub>1.inducts)
-apply blast
-apply blast
-apply clarsimp
-apply blast
-apply clarsimp
-apply(case_tac bop)
-apply clarsimp
-apply clarsimp
-apply blast
-apply (blast dest:sees_field_idemp sees_field_fun)
-apply blast
-apply (blast dest:sees_method_idemp sees_method_fun)
-apply blast
-apply blast
-apply blast
-apply blast
-apply clarify
-apply blast
-apply blast
-apply blast
-done
+proof(induct rule:WT\<^sub>1_WTs\<^sub>1.inducts)
+  case WTVal\<^sub>1 then show ?case by clarsimp
+next
+  case (WTBinOp\<^sub>1 E e\<^sub>1 T\<^sub>1 e\<^sub>2 T\<^sub>2 bop T)
+  then show ?case by(case_tac bop) force+
+next
+  case WTFAcc\<^sub>1 then show ?case
+    by (blast dest:sees_field_idemp sees_field_fun)
+next
+  case WTCall\<^sub>1 then show ?case
+    by (blast dest:sees_method_idemp sees_method_fun)
+qed blast+
 (*>*)
 
 
 lemma assumes wf: "wf_prog p P"
 shows WT\<^sub>1_is_type: "P,E \<turnstile>\<^sub>1 e :: T \<Longrightarrow> set E \<subseteq> types P \<Longrightarrow> is_type P T"
 and "P,E \<turnstile>\<^sub>1 es [::] Ts \<Longrightarrow> True"
 (*<*)
-apply(induct rule:WT\<^sub>1_WTs\<^sub>1.inducts)
-apply simp
-apply simp
-apply (simp add:typeof_lit_is_type)
-apply (blast intro:nth_mem)
-apply(simp split:bop.splits)
-apply simp
-apply (simp add:sees_field_is_type[OF _ wf])
-apply simp
-apply(fastforce dest!: sees_wf_mdecl[OF wf] simp:wf_mdecl_def)
-apply simp
-apply simp
-apply blast
-apply simp
-apply simp
-apply simp
-apply simp
-apply simp
-done
+proof(induct rule:WT\<^sub>1_WTs\<^sub>1.inducts)
+  case WTVal\<^sub>1 then show ?case by (simp add:typeof_lit_is_type)
+next
+  case WTVar\<^sub>1 then show ?case by (blast intro:nth_mem)
+next
+  case WTBinOp\<^sub>1 then show ?case by (simp split:bop.splits)
+next
+  case WTFAcc\<^sub>1 then show ?case
+    by (simp add:sees_field_is_type[OF _ wf])
+next
+  case WTCall\<^sub>1 then show ?case
+    by (fastforce dest!: sees_wf_mdecl[OF wf] simp:wf_mdecl_def)
+next
+  case WTCond\<^sub>1 then show ?case by blast
+qed simp+
 (*>*)
 
 
 subsection\<open>Well-formedness\<close>
 
 \<comment> \<open>Indices in blocks increase by 1\<close>
 
 primrec \<B> :: "expr\<^sub>1 \<Rightarrow> nat \<Rightarrow> bool"
   and \<B>s :: "expr\<^sub>1 list \<Rightarrow> nat \<Rightarrow> bool" where
 "\<B> (new C) i = True" |
 "\<B> (Cast C e) i = \<B> e i" |
 "\<B> (Val v) i = True" |
 "\<B> (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2) i = (\<B> e\<^sub>1 i \<and> \<B> e\<^sub>2 i)" |
 "\<B> (Var j) i = True" |
 "\<B> (e\<bullet>F{D}) i = \<B> e i" |
 "\<B> (j:=e) i = \<B> e i" |
 "\<B> (e\<^sub>1\<bullet>F{D} := e\<^sub>2) i = (\<B> e\<^sub>1 i \<and> \<B> e\<^sub>2 i)" |
 "\<B> (e\<bullet>M(es)) i = (\<B> e i \<and> \<B>s es i)" |
 "\<B> ({j:T ; e}) i = (i = j \<and> \<B> e (i+1))" |
 "\<B> (e\<^sub>1;;e\<^sub>2) i = (\<B> e\<^sub>1 i \<and> \<B> e\<^sub>2 i)" |
 "\<B> (if (e) e\<^sub>1 else e\<^sub>2) i = (\<B> e i \<and> \<B> e\<^sub>1 i \<and> \<B> e\<^sub>2 i)" |
 "\<B> (throw e) i = \<B> e i" |
 "\<B> (while (e) c) i = (\<B> e i \<and> \<B> c i)" |
 "\<B> (try e\<^sub>1 catch(C j) e\<^sub>2) i = (\<B> e\<^sub>1 i \<and> i=j \<and> \<B> e\<^sub>2 (i+1))" |
 
 "\<B>s [] i = True" |
 "\<B>s (e#es) i = (\<B> e i \<and> \<B>s es i)"
 
 
 definition wf_J\<^sub>1_mdecl :: "J\<^sub>1_prog \<Rightarrow> cname \<Rightarrow> expr\<^sub>1 mdecl \<Rightarrow> bool"
 where
   "wf_J\<^sub>1_mdecl P C  \<equiv>  \<lambda>(M,Ts,T,body).
     (\<exists>T'. P,Class C#Ts \<turnstile>\<^sub>1 body :: T' \<and> P \<turnstile> T' \<le> T) \<and>
     \<D> body \<lfloor>{..size Ts}\<rfloor> \<and> \<B> body (size Ts + 1)"
 
 lemma wf_J\<^sub>1_mdecl[simp]:
   "wf_J\<^sub>1_mdecl P C (M,Ts,T,body) \<equiv>
     ((\<exists>T'. P,Class C#Ts \<turnstile>\<^sub>1 body :: T' \<and> P \<turnstile> T' \<le> T) \<and>
      \<D> body \<lfloor>{..size Ts}\<rfloor> \<and> \<B> body (size Ts + 1))"
 (*<*)by (simp add:wf_J\<^sub>1_mdecl_def)(*>*)
 
 abbreviation "wf_J\<^sub>1_prog == wf_prog wf_J\<^sub>1_mdecl"
 
 end
diff --git a/thys/Jinja/Compiler/PCompiler.thy b/thys/Jinja/Compiler/PCompiler.thy
--- a/thys/Jinja/Compiler/PCompiler.thy
+++ b/thys/Jinja/Compiler/PCompiler.thy
@@ -1,278 +1,350 @@
 (*  Title:      Jinja/Compiler/PCompiler.thy
 
     Author:     Tobias Nipkow
     Copyright   TUM 2003
 *)
 
 section \<open>Program Compilation\<close>
 
 theory PCompiler
 imports "../Common/WellForm"
 begin
 
 definition compM :: "('a \<Rightarrow> 'b) \<Rightarrow> 'a mdecl \<Rightarrow> 'b mdecl"
 where
   "compM f  \<equiv>  \<lambda>(M, Ts, T, m). (M, Ts, T, f m)"
 
 definition compC :: "('a \<Rightarrow> 'b) \<Rightarrow> 'a cdecl \<Rightarrow> 'b cdecl"
 where
   "compC f  \<equiv>  \<lambda>(C,D,Fdecls,Mdecls). (C,D,Fdecls, map (compM f) Mdecls)"
 
 definition compP :: "('a \<Rightarrow> 'b) \<Rightarrow> 'a prog \<Rightarrow> 'b prog"
 where
   "compP f  \<equiv>  map (compC f)"
 
 text\<open>Compilation preserves the program structure.  Therfore lookup
 functions either commute with compilation (like method lookup) or are
 preserved by it (like the subclass relation).\<close>
 
 lemma map_of_map4:
   "map_of (map (\<lambda>(x,a,b,c).(x,a,b,f c)) ts) =
   map_option (\<lambda>(a,b,c).(a,b,f c)) \<circ> (map_of ts)"
 (*<*)
-apply(induct ts)
- apply simp
-apply(rule ext)
-apply fastforce
-done
+proof(induct ts)
+  case Nil then show ?case by simp
+qed fastforce
 (*>*)
 
 
 lemma class_compP:
   "class P C = Some (D, fs, ms)
   \<Longrightarrow> class (compP f P) C = Some (D, fs, map (compM f) ms)"
 (*<*)by(simp add:class_def compP_def compC_def map_of_map4)(*>*)
 
 
 lemma class_compPD:
   "class (compP f P) C = Some (D, fs, cms)
   \<Longrightarrow> \<exists>ms. class P C = Some(D,fs,ms) \<and> cms = map (compM f) ms"
 (*<*)by(clarsimp simp add:class_def compP_def compC_def map_of_map4)(*>*)
 
 
 lemma [simp]: "is_class (compP f P) C = is_class P C"
 (*<*)by(auto simp:is_class_def dest: class_compP class_compPD)(*>*)
 
 
 lemma [simp]: "class (compP f P) C = map_option (\<lambda>c. snd(compC f (C,c))) (class P C)"
 (*<*)
-apply(simp add:compP_def compC_def class_def map_of_map4)
-apply(simp add:split_def)
-done
+by(simp add:compP_def compC_def class_def map_of_map4)
+  (simp add:split_def)
 (*>*)
 
 
 lemma sees_methods_compP:
   "P \<turnstile> C sees_methods Mm \<Longrightarrow>
   compP f P \<turnstile> C sees_methods (map_option (\<lambda>((Ts,T,m),D). ((Ts,T,f m),D)) \<circ> Mm)"
-(*<*)
-apply(erule Methods.induct)
- apply(rule sees_methods_Object)
-  apply(erule class_compP)
- apply(rule ext)
- apply(simp add:compM_def map_of_map4 option.map_comp)
- apply(case_tac "map_of ms x")
-  apply simp
- apply fastforce
-apply(rule sees_methods_rec)
-   apply(erule class_compP)
-  apply assumption
- apply assumption
-apply(rule ext)
-apply(simp add:map_add_def compM_def map_of_map4 option.map_comp split:option.split)
-done
+(*<*)(is "?P \<Longrightarrow> compP f P \<turnstile> C sees_methods (?map Mm)")
+proof(induct rule: Methods.induct)
+  case Object: (sees_methods_Object D fs ms Mm)
+  let ?Mm1 = "\<lambda>x. map_option ((\<lambda>m. (m, Object)) \<circ> (\<lambda>(Ts, T, m). (Ts, T, f m))) (map_of ms x)"
+  let ?Mm2 = "\<lambda>x. map_option (case_prod (\<lambda>(Ts, T, m).
+                   Pair (Ts, T, f m)) \<circ> (\<lambda>m. (m, Object))) (map_of ms x)"
+  have Mm_eq: "\<And>x. ?Mm1 x = ?Mm2 x"
+  proof -
+    fix x show "?Mm1 x = ?Mm2 x"
+    proof(cases "map_of ms x")
+      case None then show ?thesis by simp
+    qed fastforce
+  qed
+
+  have Mm: "Mm = map_option (\<lambda>m. (m, Object)) \<circ> map_of ms" by fact
+  let ?Mm = "map_option (\<lambda>m. (m, Object)) \<circ> map_of (map (compM f) ms)"
+  let ?Mm' = "?map Mm"
+  have "?Mm' = ?Mm"
+    by(rule ext) (simp add:Mm Mm_eq compM_def map_of_map4 option.map_comp)
+  then show ?case by(rule sees_methods_Object[OF class_compP[OF Object(1)]])
+next
+  case rec: (sees_methods_rec C D fs ms Mm Mm')
+  have Mm': "Mm' = Mm ++ (map_option (\<lambda>m. (m, C)) \<circ> map_of ms)" by fact
+  let ?Mm' = "?map Mm'"
+  let ?Mm'' = "(?map Mm) ++ (map_option (\<lambda>m. (m, C)) \<circ> map_of (map (compM f) ms))"
+  have "?Mm' = ?Mm''"
+    by(rule ext) (simp add:Mm' map_add_def compM_def map_of_map4)
+  moreover have "compP f P \<turnstile> C sees_methods ?Mm''"
+    using sees_methods_rec[OF class_compP[OF rec(1)] rec(2,4)] by fast
+  ultimately show "compP f P \<turnstile> C sees_methods ?Mm'" by simp
+qed
 (*>*)
 
 
 lemma sees_method_compP:
   "P \<turnstile> C sees M: Ts\<rightarrow>T = m in D \<Longrightarrow>
   compP f P \<turnstile> C sees M: Ts\<rightarrow>T = (f m) in D"
 (*<*)by(fastforce elim:sees_methods_compP simp add:Method_def)(*>*)
 
 
 lemma [simp]:
   "P \<turnstile> C sees M: Ts\<rightarrow>T = m in D \<Longrightarrow>
   method (compP f P) C M = (D,Ts,T,f m)"
 (*<*)
-apply(drule sees_method_compP)
-apply(simp add:method_def)
-apply(rule the_equality)
- apply simp
-apply(fastforce dest:sees_method_fun)
-done
+proof -
+  let ?P = "\<lambda>(D, Ts, T, m). compP f P \<turnstile> C sees M:  Ts\<rightarrow>T = m in D"
+  let ?a = "(D, Ts, T, f m)"
+  assume cM: "P \<turnstile> C sees M: Ts\<rightarrow>T = m in D"
+  have compP_cM: "?P ?a" using sees_method_compP[OF cM] by simp
+  moreover {
+    fix x assume "?P x" then have "x = ?a"
+      using compP_cM by(fastforce dest:sees_method_fun)
+  }
+  ultimately have "(THE x. ?P x) = ?a" by(rule the_equality)
+  then show ?thesis by(simp add:method_def)
+qed
 (*>*)
 
 
 lemma sees_methods_compPD:
   "\<lbrakk> cP \<turnstile> C sees_methods Mm'; cP = compP f P \<rbrakk> \<Longrightarrow>
   \<exists>Mm. P \<turnstile> C sees_methods Mm \<and>
         Mm' = (map_option (\<lambda>((Ts,T,m),D). ((Ts,T,f m),D)) \<circ> Mm)"
-(*<*)
-apply(erule Methods.induct)
- apply(clarsimp simp:compC_def)
- apply(rule exI)
- apply(rule conjI, erule sees_methods_Object)
- apply(rule refl)
- apply(rule ext)
- apply(simp add:compM_def map_of_map4 option.map_comp)
- apply(case_tac "map_of b x")
-  apply simp
- apply fastforce
-apply(clarsimp simp:compC_def)
-apply(rule exI, rule conjI)
-apply(erule (2) sees_methods_rec)
- apply(rule refl)
-apply(rule ext)
-apply(simp add:map_add_def compM_def map_of_map4 option.map_comp split:option.split)
-done
+(*<*)(is "\<lbrakk> ?P; ?Q \<rbrakk> \<Longrightarrow> \<exists>Mm. P \<turnstile> C sees_methods Mm \<and> Mm' = (?map Mm)")
+proof(induct rule: Methods.induct)
+  case Object: (sees_methods_Object D fs ms Mm)
+  then obtain ms' where P_Obj: "class P Object = \<lfloor>(D, fs, ms')\<rfloor>"
+    and ms: "ms = map (compM f) ms'" by(clarsimp simp:compC_def)
+
+  let ?Mm1 = "\<lambda>x. map_option ((\<lambda>m. (m, Object)) \<circ> (\<lambda>(Ts, T, m). (Ts, T, f m))) (map_of ms' x)"
+  let ?Mm2 = "\<lambda>x. map_option (case_prod (\<lambda>(Ts, T, m). Pair (Ts, T, f m)) \<circ> (\<lambda>m. (m, Object)))
+          (map_of ms' x)"
+  have Mm_eq: "\<And>x. ?Mm1 x = ?Mm2 x"
+  proof -
+    fix x show "?Mm1 x = ?Mm2 x"
+    proof(cases "map_of ms' x")
+      case None then show ?thesis by simp
+    qed fastforce
+  qed
+
+  let ?Mm = "map_option (\<lambda>m. (m,Object)) \<circ> map_of ms'"
+  let ?Mm' = "?map ?Mm"
+  have Mm: "Mm = map_option (\<lambda>m. (m, Object)) \<circ> map_of ms" by fact
+  have "P \<turnstile> Object sees_methods ?Mm"
+    using sees_methods_Object[OF P_Obj] by simp
+  moreover have "Mm = ?Mm'"
+    by(rule ext) (simp add:Mm_eq Mm ms compM_def map_of_map4 option.map_comp)
+  ultimately show ?case by fast
+next
+  case rec: (sees_methods_rec C D fs ms Mm Mm')
+  then obtain ms' Mm\<^sub>D where P_D: "class P C = \<lfloor>(D, fs, ms')\<rfloor>"
+     and ms: "ms = map (compM f) ms'" and C_nObj: "C \<noteq> Object"
+     and Mm\<^sub>D: "P \<turnstile> D sees_methods Mm\<^sub>D"
+     and Mm: "Mm = (\<lambda>a. map_option (case_prod (\<lambda>(Ts, T, m). Pair (Ts, T, f m))) (Mm\<^sub>D a))"
+    by(clarsimp simp:compC_def)
+
+  let ?Mm = "Mm\<^sub>D ++ (map_option (\<lambda>m. (m, C)) \<circ> map_of ms')"
+  let ?Mm1 = "Mm ++ (map_option (\<lambda>m. (m, C)) \<circ> map_of ms)"
+  let ?Mm2 = "Mm ++ (map_option (\<lambda>m. (m, C)) \<circ> map_of (map (compM f) ms'))"
+  let ?Mm3 = "?map ?Mm"
+  have "Mm' = ?Mm1" by fact
+  also have "\<dots> = ?Mm2" using ms by simp
+  also have "\<dots> = ?Mm3"
+    by(rule ext)(simp add:Mm map_add_def compM_def map_of_map4)
+  moreover have "P \<turnstile> C sees_methods ?Mm"
+    using sees_methods_rec[OF P_D C_nObj Mm\<^sub>D] by simp
+  ultimately show ?case by fast
+qed
 (*>*)
 
 
 lemma sees_method_compPD:
   "compP f P \<turnstile> C sees M: Ts\<rightarrow>T = fm in D \<Longrightarrow>
   \<exists>m. P \<turnstile> C sees M: Ts\<rightarrow>T = m in D \<and> f m = fm"
 (*<*)
-apply(simp add:Method_def)
-apply clarify
-apply(drule sees_methods_compPD[OF _ refl])
-apply clarsimp
-apply blast
-done
+proof -
+  assume "compP f P \<turnstile> C sees M: Ts\<rightarrow>T = fm in D"
+  then obtain Mm where Mm: "compP f P \<turnstile> C sees_methods Mm"
+     and MmM: "Mm M = \<lfloor>((Ts, T, fm), D)\<rfloor>"
+    by(clarsimp simp:Method_def)
+  show ?thesis using sees_methods_compPD[OF Mm refl] MmM
+    by(fastforce simp: Method_def)
+qed
 (*>*)
 
 
 lemma [simp]: "subcls1(compP f P) = subcls1 P"
 (*<*)
 by(fastforce simp add: is_class_def compC_def intro:subcls1I order_antisym dest:subcls1D)
 (*>*)
 
 
 lemma compP_widen[simp]: "(compP f P \<turnstile> T \<le> T') = (P \<turnstile> T \<le> T')"
 (*<*)by(cases T')(simp_all add:widen_Class)(*>*)
 
 
 lemma [simp]: "(compP f P \<turnstile> Ts [\<le>] Ts') = (P \<turnstile> Ts [\<le>] Ts')"
 (*<*)
-apply(induct Ts)
- apply simp
-apply(cases Ts')
-apply(auto simp:fun_of_def)
-done
+proof(induct Ts)
+  case (Cons a Ts)
+  then show ?case by(cases Ts')(auto simp:fun_of_def)
+qed simp
 (*>*)
 
 
 lemma [simp]: "is_type (compP f P) T = is_type P T"
 (*<*)by(cases T) simp_all(*>*)
 
 
 lemma [simp]: "(compP (f::'a\<Rightarrow>'b) P \<turnstile> C has_fields FDTs) = (P \<turnstile> C has_fields FDTs)"
 (*<*)
  (is "?A = ?B")
 proof
   { fix cP::"'b prog" assume "cP \<turnstile> C has_fields FDTs"
     hence "cP = compP f P \<Longrightarrow> P \<turnstile> C has_fields FDTs"
     proof induct
       case has_fields_Object
       thus ?case by(fast intro:Fields.has_fields_Object dest:class_compPD)
     next
       case has_fields_rec
       thus ?case by(fast intro:Fields.has_fields_rec dest:class_compPD)
     qed
   } note lem = this
   assume ?A
   with lem show ?B by blast
 next
   assume ?B
   thus ?A
   proof induct
     case has_fields_Object
     thus ?case by(fast intro:Fields.has_fields_Object class_compP)
   next
     case has_fields_rec
     thus ?case by(fast intro:Fields.has_fields_rec class_compP)
   qed
 qed
 (*>*)
 
 
 lemma [simp]: "fields (compP f P) C = fields P C"
 (*<*)by(simp add:fields_def)(*>*)
 
 
 lemma [simp]: "(compP f P \<turnstile> C sees F:T in D) = (P \<turnstile> C sees F:T in D)"
 (*<*)by(simp add:sees_field_def)(*>*)
 
 
 lemma [simp]: "field (compP f P) F D = field P F D"
 (*<*)by(simp add:field_def)(*>*)
 
 
 subsection\<open>Invariance of @{term wf_prog} under compilation\<close>
 
 lemma [iff]: "distinct_fst (compP f P) = distinct_fst P"
 (*<*)
-apply(simp add:distinct_fst_def compP_def compC_def)
-apply(induct P)
-apply (auto simp:image_iff)
-done
+by (induct P)
+   (auto simp:distinct_fst_def compP_def compC_def image_iff)
 (*>*)
 
 
 lemma [iff]: "distinct_fst (map (compM f) ms) = distinct_fst ms"
 (*<*)
-apply(simp add:distinct_fst_def compM_def)
-apply(induct ms)
-apply (auto simp:image_iff)
-done
+by (induct ms)
+   (auto simp:distinct_fst_def compM_def image_iff)
 (*>*)
 
 
 lemma [iff]: "wf_syscls (compP f P) = wf_syscls P"
 (*<*)by(simp add:wf_syscls_def compP_def compC_def image_def Bex_def)(*>*)
 
 
 lemma [iff]: "wf_fdecl (compP f P) = wf_fdecl P"
 (*<*)by(simp add:wf_fdecl_def)(*>*)
 
 
 lemma set_compP:
  "((C,D,fs,ms') \<in> set(compP f P)) =
   (\<exists>ms. (C,D,fs,ms) \<in> set P \<and> ms' = map (compM f) ms)"
 (*<*)by(fastforce simp add:compP_def compC_def image_iff Bex_def)(*>*)
 
 
 lemma wf_cdecl_compPI:
   "\<lbrakk> \<And>C M Ts T m. 
      \<lbrakk> wf_mdecl wf\<^sub>1 P C (M,Ts,T,m); P \<turnstile> C sees M:Ts\<rightarrow>T = m in C \<rbrakk>
      \<Longrightarrow> wf_mdecl wf\<^sub>2 (compP f P) C (M,Ts,T, f m);
     \<forall>x\<in>set P. wf_cdecl wf\<^sub>1 P x; x \<in> set (compP f P); wf_prog p P \<rbrakk>
   \<Longrightarrow> wf_cdecl wf\<^sub>2 (compP f P) x"
 (*<*)
-apply(clarsimp simp add:wf_cdecl_def Ball_def set_compP)
-apply(rename_tac C D fs ms)
-apply(rule conjI)
- apply (clarsimp simp:compM_def)
- apply (drule (2) mdecl_visible)
- apply simp
-apply(clarify)
-apply(drule sees_method_compPD[where f = f])
-apply clarsimp 
-apply(fastforce simp:image_iff compM_def)
-done
+proof -
+  assume
+   wfm: "\<And>C M Ts T m. \<lbrakk> wf_mdecl wf\<^sub>1 P C (M,Ts,T,m); P \<turnstile> C sees M:Ts\<rightarrow>T = m in C \<rbrakk>
+     \<Longrightarrow> wf_mdecl wf\<^sub>2 (compP f P) C (M,Ts,T, f m)"
+    and wfc: "\<forall>x\<in>set P. wf_cdecl wf\<^sub>1 P x"
+    and compP: "x \<in> set (compP f P)" and wf: "wf_prog p P"
+  obtain C D fs ms where x: "x = (C, D, fs, map (compM f) ms)"
+    and x_set: "(C, D, fs, ms) \<in> set P"
+   using compP by(case_tac x) (clarsimp simp: set_compP)
+  have wfc': "wf_cdecl wf\<^sub>1 P (C, D, fs, ms)" using wfc x_set by fast
+  let ?P = "compP f P" and ?ms = "compM f ` set ms"
+  { fix M Ts T m
+    assume M: "(M,Ts,T,m) \<in> set ms"
+    then have "wf_mdecl wf\<^sub>1 P C (M, Ts, T, m)" using wfc'
+      by(simp add:wf_cdecl_def)
+    moreover have cM: "P \<turnstile> C sees M :  Ts\<rightarrow>T = m in C" using M
+      by(rule mdecl_visible[OF wf x_set])
+    ultimately have "wf_mdecl wf\<^sub>2 (compP f P) C (M, Ts, T, f m)"
+      by(rule wfm)
+  }
+  then have "\<forall>m \<in> ?ms. wf_mdecl wf\<^sub>2 ?P C m"
+    by (clarsimp simp:compM_def)
+  moreover have "C \<noteq> Object \<longrightarrow>
+   (\<forall>(M,Ts,T,m)\<in>?ms.
+      \<forall>D' Ts' T' m'. ?P \<turnstile> D sees M:Ts' \<rightarrow> T' = m' in D' \<longrightarrow>
+                       P \<turnstile> Ts' [\<le>] Ts \<and> P \<turnstile> T \<le> T')"
+  proof -
+    { fix M Ts T m D' Ts' T' m'
+      assume "C \<noteq> Object" and "(M,Ts,T,m)\<in>?ms"
+        and dM: "?P \<turnstile> D sees M:Ts' \<rightarrow> T' = m' in D'"
+      then have "P \<turnstile> Ts' [\<le>] Ts \<and> P \<turnstile> T \<le> T'"
+       using wfc' sees_method_compPD[OF dM]
+        by(fastforce simp:wf_cdecl_def image_iff compM_def)
+    }
+    then show ?thesis by fast
+  qed
+  moreover have "(\<forall>f\<in>set fs. wf_fdecl P f) \<and> distinct_fst fs \<and> distinct_fst ms
+     \<and> (C \<noteq> Object \<longrightarrow> is_class P D \<and> \<not> P \<turnstile> D \<preceq>\<^sup>* C)" using wfc'
+    by(simp add: wf_cdecl_def)
+  ultimately show ?thesis using x by(simp add:wf_cdecl_def)
+qed
 (*>*)
 
 
 lemma wf_prog_compPI:
 assumes lift: 
   "\<And>C M Ts T m. 
     \<lbrakk> P \<turnstile> C sees M:Ts\<rightarrow>T = m in C; wf_mdecl wf\<^sub>1 P C (M,Ts,T,m) \<rbrakk>
     \<Longrightarrow> wf_mdecl wf\<^sub>2 (compP f P) C (M,Ts,T, f m)"
 and wf: "wf_prog wf\<^sub>1 P"
 shows "wf_prog wf\<^sub>2 (compP f P)"
 (*<*)
 using wf
 by (simp add:wf_prog_def) (blast intro:wf_cdecl_compPI lift wf)
 (*>*)
 
 
 end
diff --git a/thys/JinjaDCI/Compiler/Correctness1.thy b/thys/JinjaDCI/Compiler/Correctness1.thy
--- a/thys/JinjaDCI/Compiler/Correctness1.thy
+++ b/thys/JinjaDCI/Compiler/Correctness1.thy
@@ -1,1058 +1,1064 @@
 (*  Title:      JinjaDCI/Compiler/Correctness1.thy
     Author:     Tobias Nipkow, Susannah Mansky
     Copyright   TUM 2003, UIUC 2019-20
 
     Based on the Jinja theory Compiler/Correctness1.thy by Tobias Nipkow
 *)
 
 section \<open> Correctness of Stage 1 \<close>
 
 theory Correctness1
 imports J1WellForm Compiler1
 begin
 
 subsection\<open>Correctness of program compilation \<close>
 
 primrec unmod :: "expr\<^sub>1 \<Rightarrow> nat \<Rightarrow> bool"
   and unmods :: "expr\<^sub>1 list \<Rightarrow> nat \<Rightarrow> bool" where
 "unmod (new C) i = True" |
 "unmod (Cast C e) i = unmod e i" |
 "unmod (Val v) i = True" |
 "unmod (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2) i = (unmod e\<^sub>1 i \<and> unmod e\<^sub>2 i)" |
 "unmod (Var i) j = True" |
 "unmod (i:=e) j = (i \<noteq> j \<and> unmod e j)" |
 "unmod (e\<bullet>F{D}) i = unmod e i" |
 "unmod (C\<bullet>\<^sub>sF{D}) i = True" |
 "unmod (e\<^sub>1\<bullet>F{D}:=e\<^sub>2) i = (unmod e\<^sub>1 i \<and> unmod e\<^sub>2 i)" |
 "unmod (C\<bullet>\<^sub>sF{D}:=e\<^sub>2) i = unmod e\<^sub>2 i" |
 "unmod (e\<bullet>M(es)) i = (unmod e i \<and> unmods es i)" |
 "unmod (C\<bullet>\<^sub>sM(es)) i = unmods es i" |
 "unmod {j:T; e} i = unmod e i" |
 "unmod (e\<^sub>1;;e\<^sub>2) i = (unmod e\<^sub>1 i \<and>  unmod e\<^sub>2 i)" |
 "unmod (if (e) e\<^sub>1 else e\<^sub>2) i = (unmod e i \<and> unmod e\<^sub>1 i \<and> unmod e\<^sub>2 i)" |
 "unmod (while (e) c) i = (unmod e i \<and> unmod c i)" |
 "unmod (throw e) i = unmod e i" |
 "unmod (try e\<^sub>1 catch(C i) e\<^sub>2) j = (unmod e\<^sub>1 j \<and> (if i=j then False else unmod e\<^sub>2 j))" |
 "unmod (INIT C (Cs,b) \<leftarrow> e) i = unmod e i" |
 "unmod (RI(C,e);Cs \<leftarrow> e') i = (unmod e i \<and> unmod e' i)" |
 
 "unmods ([]) i = True" |
 "unmods (e#es) i = (unmod e i \<and> unmods es i)"
 
 lemma hidden_unmod: "\<And>Vs. hidden Vs i \<Longrightarrow> unmod (compE\<^sub>1 Vs e) i" and
  "\<And>Vs. hidden Vs i \<Longrightarrow> unmods (compEs\<^sub>1 Vs es) i"
 (*<*)
-apply(induct e and es rule: compE\<^sub>1.induct compEs\<^sub>1.induct)
-apply (simp_all add:hidden_inacc)
-apply(auto simp add:hidden_def)
-done
+proof(induct e and es rule: compE\<^sub>1.induct compEs\<^sub>1.induct)
+  case TryCatch
+  then show ?case by(simp add:hidden_inacc)(auto simp add:hidden_def)
+qed (simp_all add:hidden_inacc)
 (*>*)
 
 
 lemma eval\<^sub>1_preserves_unmod:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,(h,ls,sh)\<rangle> \<Rightarrow> \<langle>e',(h',ls',sh')\<rangle>; unmod e i; i < size ls \<rbrakk>
   \<Longrightarrow> ls ! i = ls' ! i"
 and "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>es,(h,ls,sh)\<rangle> [\<Rightarrow>] \<langle>es',(h',ls',sh')\<rangle>; unmods es i; i < size ls \<rbrakk>
       \<Longrightarrow> ls ! i = ls' ! i"
 (*<*)
 proof(induct rule:eval\<^sub>1_evals\<^sub>1_inducts)
   case (RInitInitFail\<^sub>1 e h l sh a h' l' sh' C sfs i sh'' D Cs e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1)
   have "final (throw a)" using eval\<^sub>1_final[OF RInitInitFail\<^sub>1.hyps(1)] by simp
   then show ?case using RInitInitFail\<^sub>1 by(auto simp: eval\<^sub>1_preserves_len)
 qed(auto dest!:eval\<^sub>1_preserves_len evals\<^sub>1_preserves_len split:if_split_asm)
 (*>*)
 
 
 lemma LAss_lem:
   "\<lbrakk>x \<in> set xs; size xs \<le> size ys \<rbrakk>
   \<Longrightarrow> m\<^sub>1 \<subseteq>\<^sub>m m\<^sub>2(xs[\<mapsto>]ys) \<Longrightarrow> m\<^sub>1(x\<mapsto>y) \<subseteq>\<^sub>m m\<^sub>2(xs[\<mapsto>]ys[last_index xs x := y])"
 (*<*)
 by(simp add:map_le_def fun_upds_apply eq_sym_conv)
 (*>*)
 lemma Block_lem:
 fixes l :: "'a \<rightharpoonup> 'b"
 assumes 0: "l \<subseteq>\<^sub>m [Vs [\<mapsto>] ls]"
     and 1: "l' \<subseteq>\<^sub>m [Vs [\<mapsto>] ls', V\<mapsto>v]"
     and hidden: "V \<in> set Vs \<Longrightarrow> ls ! last_index Vs V = ls' ! last_index Vs V"
     and size: "size ls = size ls'"    "size Vs < size ls'"
 shows "l'(V := l V) \<subseteq>\<^sub>m [Vs [\<mapsto>] ls']"
 (*<*)
 proof -
   have "l'(V := l V) \<subseteq>\<^sub>m [Vs [\<mapsto>] ls', V\<mapsto>v](V := l V)"
     using 1 by(rule map_le_upd)
   also have "\<dots> = [Vs [\<mapsto>] ls'](V := l V)" by simp
   also have "\<dots> \<subseteq>\<^sub>m [Vs [\<mapsto>] ls']"
   proof (cases "l V")
     case None thus ?thesis by simp
   next
     case (Some w)
     hence "[Vs [\<mapsto>] ls] V = Some w"
       using 0 by(force simp add: map_le_def split:if_splits)
     hence VinVs: "V \<in> set Vs" and w: "w = ls ! last_index Vs V"
       using size by(auto simp add:fun_upds_apply split:if_splits)
     hence "w = ls' ! last_index Vs V" using hidden[OF VinVs] by simp
     hence "[Vs [\<mapsto>] ls'](V := l V) = [Vs [\<mapsto>] ls']" using Some size VinVs
       by(simp add: map_upds_upd_conv_last_index)
     thus ?thesis by simp
   qed
   finally show ?thesis .
 qed
 (*>*)
 
 (*<*)
 declare fun_upd_apply[simp del]
 (*>*)
 
 
 text\<open>\noindent The main theorem: \<close>
 
 theorem assumes wf: "wwf_J_prog P"
 shows eval\<^sub>1_eval: "P \<turnstile> \<langle>e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',(h',l',sh')\<rangle>
   \<Longrightarrow> (\<And>Vs ls. \<lbrakk> fv e \<subseteq> set Vs;  l \<subseteq>\<^sub>m [Vs[\<mapsto>]ls]; size Vs + max_vars e \<le> size ls \<rbrakk>
        \<Longrightarrow> \<exists>ls'. compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs e,(h,ls,sh)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h',ls',sh')\<rangle> \<and> l' \<subseteq>\<^sub>m [Vs[\<mapsto>]ls'])"
 (*<*)
   (is "_ \<Longrightarrow> (\<And>Vs ls. PROP ?P e h l sh e' h' l' sh' Vs ls)"
    is "_ \<Longrightarrow> (\<And>Vs ls. \<lbrakk> _; _; _ \<rbrakk> \<Longrightarrow> \<exists>ls'. ?Post e h l sh e' h' l' sh' Vs ls ls')")
 (*>*)
 
 and evals\<^sub>1_evals: "P \<turnstile> \<langle>es,(h,l,sh)\<rangle> [\<Rightarrow>] \<langle>es',(h',l',sh')\<rangle>
     \<Longrightarrow> (\<And>Vs ls. \<lbrakk> fvs es \<subseteq> set Vs;  l \<subseteq>\<^sub>m [Vs[\<mapsto>]ls]; size Vs + max_varss es \<le> size ls \<rbrakk>
          \<Longrightarrow> \<exists>ls'. compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compEs\<^sub>1 Vs es,(h,ls,sh)\<rangle> [\<Rightarrow>] \<langle>compEs\<^sub>1 Vs es',(h',ls',sh')\<rangle> \<and>
                       l' \<subseteq>\<^sub>m [Vs[\<mapsto>]ls'])"
 (*<*)
   (is "_ \<Longrightarrow> (\<And>Vs ls. PROP ?Ps es h l sh es' h' l' sh' Vs ls)"
    is "_ \<Longrightarrow> (\<And>Vs ls. \<lbrakk> _; _; _\<rbrakk> \<Longrightarrow> \<exists>ls'. ?Posts es h l sh es' h' l' sh' Vs ls ls')")
 proof (induct rule:eval_evals_inducts)
   case Nil thus ?case by(fastforce intro!:Nil\<^sub>1)
 next
   case (Cons e h l sh v h' l' sh' es es' h\<^sub>2 l\<^sub>2 sh\<^sub>2)
   have "PROP ?P e h l sh (Val v) h' l' sh' Vs ls" by fact
   with Cons.prems
   obtain ls' where 1: "?Post e h l sh (Val v) h' l' sh' Vs ls ls'"
     "size ls = size ls'" by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?Ps es h' l' sh' es' h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls'" by fact
   with 1 Cons.prems
   obtain ls\<^sub>2 where 2: "?Posts es h' l' sh' es' h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls' ls\<^sub>2" by(auto)
   from 1 2 Cons show ?case by(auto intro!:Cons\<^sub>1)
 next
   case ConsThrow thus ?case
     by(fastforce intro!:ConsThrow\<^sub>1 dest: eval_final)
 next
   case (Block e h l V sh e' h' l' sh' T)
   let ?Vs = "Vs @ [V]"
   have IH:
   "\<lbrakk>fv e \<subseteq> set ?Vs; l(V := None) \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls];
     size ?Vs + max_vars e \<le> size ls\<rbrakk>
    \<Longrightarrow> \<exists>ls'. compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 ?Vs e,(h,ls,sh)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h', ls',sh')\<rangle> \<and>
              l' \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls']" and
   fv: "fv {V:T; e} \<subseteq> set Vs" and rel: "l \<subseteq>\<^sub>m [Vs [\<mapsto>] ls]" and
   len: "length Vs + max_vars {V:T; e} \<le> length ls" by fact+
   have len': "length Vs < length ls" using len by auto
   have "fv e \<subseteq> set ?Vs" using fv by auto
   moreover have "l(V := None) \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls]" using rel len' by simp
   moreover have "size ?Vs + max_vars e \<le> size ls" using len by simp
   ultimately obtain ls' where
    1: "compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 ?Vs e,(h,ls,sh)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h',ls',sh')\<rangle>"
    and rel': "l' \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls']" using IH by blast
   have [simp]: "length ls = length ls'" by(rule eval\<^sub>1_preserves_len[OF 1])
   show "\<exists>ls'. compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs {V:T; e},(h,ls,sh)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h',ls',sh')\<rangle>
               \<and> l'(V := l V) \<subseteq>\<^sub>m [Vs [\<mapsto>] ls']" (is "\<exists>ls'. ?R ls'")
   proof
     show "?R ls'"
     proof
       show "compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs {V:T; e},(h,ls,sh)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h',ls',sh')\<rangle>"
         using 1 by(simp add:Block\<^sub>1)
     next
       show "l'(V := l V) \<subseteq>\<^sub>m [Vs [\<mapsto>] ls']"
       proof -
         have "l' \<subseteq>\<^sub>m [Vs [\<mapsto>] ls', V \<mapsto> ls' ! length Vs]"
           using len' rel' by simp
         moreover
         { assume VinVs: "V \<in> set Vs"
           hence "hidden (Vs @ [V]) (last_index Vs V)"
             by(rule hidden_last_index)
           hence "unmod (compE\<^sub>1 (Vs @ [V]) e) (last_index Vs V)"
             by(rule hidden_unmod)
           moreover have "last_index Vs V < length ls"
             using len' VinVs by simp
           ultimately have "ls ! last_index Vs V = ls' ! last_index Vs V"
             by(rule eval\<^sub>1_preserves_unmod[OF 1])
         }
         ultimately show ?thesis using Block_lem[OF rel] len' by auto
       qed
     qed
   qed
 next
   case (TryThrow e' h l sh a h' l' sh' D fs C V e\<^sub>2)
   have "PROP ?P e' h l sh (Throw a) h' l' sh' Vs ls" by fact
   with TryThrow.prems
   obtain ls' where 1: "?Post e' h l sh (Throw a) h' l' sh' Vs ls ls'"  by(auto)
   show ?case using 1 TryThrow.hyps by(auto intro!:eval\<^sub>1_evals\<^sub>1.TryThrow\<^sub>1)
 next
   case (TryCatch e\<^sub>1 h l sh a h\<^sub>1 l\<^sub>1 sh\<^sub>1 D fs C e\<^sub>2 V e' h\<^sub>2 l\<^sub>2 sh\<^sub>2)
   let ?e = "try e\<^sub>1 catch(C V) e\<^sub>2"
   have IH\<^sub>1: "\<lbrakk>fv e\<^sub>1 \<subseteq> set Vs; l \<subseteq>\<^sub>m [Vs [\<mapsto>] ls];
               size Vs + max_vars e\<^sub>1 \<le> length ls\<rbrakk>
           \<Longrightarrow> \<exists>ls\<^sub>1. compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs e\<^sub>1,(h,ls,sh)\<rangle> \<Rightarrow>
                                 \<langle>fin\<^sub>1 (Throw a),(h\<^sub>1,ls\<^sub>1,sh\<^sub>1)\<rangle> \<and>
                     l\<^sub>1 \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>1]" and
     fv: "fv ?e \<subseteq> set Vs" and
     rel: "l \<subseteq>\<^sub>m [Vs [\<mapsto>] ls]" and
     len: "length Vs + max_vars ?e \<le> length ls" by fact+
   have "fv e\<^sub>1 \<subseteq> set Vs" using fv by auto
   moreover have "length Vs + max_vars e\<^sub>1 \<le> length ls" using len by(auto)
   ultimately obtain ls\<^sub>1 where
     1: "compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs e\<^sub>1,(h,ls,sh)\<rangle> \<Rightarrow> \<langle>Throw a,(h\<^sub>1,ls\<^sub>1,sh\<^sub>1)\<rangle>"
     and rel\<^sub>1: "l\<^sub>1 \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>1]" using IH\<^sub>1 rel by fastforce
   from 1 have [simp]: "size ls = size ls\<^sub>1" by(rule eval\<^sub>1_preserves_len)
   let ?Vs = "Vs @ [V]" let ?ls = "(ls\<^sub>1[size Vs:=Addr a])"
   have IH\<^sub>2: "\<lbrakk>fv e\<^sub>2 \<subseteq> set ?Vs; l\<^sub>1(V \<mapsto> Addr a) \<subseteq>\<^sub>m [?Vs [\<mapsto>] ?ls];
               length ?Vs + max_vars e\<^sub>2 \<le> length ?ls\<rbrakk> \<Longrightarrow> \<exists>ls\<^sub>2.
        compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 ?Vs e\<^sub>2,(h\<^sub>1,?ls,sh\<^sub>1)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h\<^sub>2, ls\<^sub>2, sh\<^sub>2)\<rangle> \<and>
        l\<^sub>2 \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls\<^sub>2]" by fact
   have len\<^sub>1: "size Vs < size ls\<^sub>1" using len by(auto)
   have "fv e\<^sub>2 \<subseteq> set ?Vs" using fv by auto
   moreover have "l\<^sub>1(V \<mapsto> Addr a) \<subseteq>\<^sub>m [?Vs [\<mapsto>] ?ls]" using rel\<^sub>1 len\<^sub>1 by simp
   moreover have "length ?Vs + max_vars e\<^sub>2 \<le> length ?ls" using len by(auto)
   ultimately obtain ls\<^sub>2 where
     2: "compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 ?Vs e\<^sub>2,(h\<^sub>1,?ls,sh\<^sub>1)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h\<^sub>2, ls\<^sub>2, sh\<^sub>2)\<rangle>"
     and rel\<^sub>2: "l\<^sub>2 \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls\<^sub>2]"  using IH\<^sub>2 by blast
   from 2 have [simp]: "size ls\<^sub>1 = size ls\<^sub>2"
     by(fastforce dest: eval\<^sub>1_preserves_len)
   show "\<exists>ls\<^sub>2. compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs ?e,(h,ls,sh)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h\<^sub>2,ls\<^sub>2,sh\<^sub>2)\<rangle> \<and>
               l\<^sub>2(V := l\<^sub>1 V) \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>2]"  (is "\<exists>ls\<^sub>2. ?R ls\<^sub>2")
   proof
     show "?R ls\<^sub>2"
     proof
       have hp: "h\<^sub>1 a = Some (D, fs)" by fact
       have "P \<turnstile> D \<preceq>\<^sup>* C" by fact hence caught: "compP\<^sub>1 P \<turnstile> D \<preceq>\<^sup>* C" by simp
       from TryCatch\<^sub>1[OF 1 _ caught len\<^sub>1 2, OF hp]
       show "compP\<^sub>1 P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs ?e,(h,ls,sh)\<rangle> \<Rightarrow> \<langle>fin\<^sub>1 e',(h\<^sub>2,ls\<^sub>2,sh\<^sub>2)\<rangle>" by simp
     next
       show "l\<^sub>2(V := l\<^sub>1 V) \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>2]"
       proof -
         have "l\<^sub>2 \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>2, V \<mapsto> ls\<^sub>2 ! length Vs]"
           using len\<^sub>1 rel\<^sub>2 by simp
         moreover
         { assume VinVs: "V \<in> set Vs"
           hence "hidden (Vs @ [V]) (last_index Vs V)" by(rule hidden_last_index)
           hence "unmod (compE\<^sub>1 (Vs @ [V]) e\<^sub>2) (last_index Vs V)"
             by(rule hidden_unmod)
           moreover have "last_index Vs V < length ?ls"
             using len\<^sub>1 VinVs by simp
           ultimately have "?ls ! last_index Vs V = ls\<^sub>2 ! last_index Vs V"
             by(rule eval\<^sub>1_preserves_unmod[OF 2])
           moreover have "last_index Vs V < size Vs" using VinVs by simp
           ultimately have "ls\<^sub>1 ! last_index Vs V = ls\<^sub>2 ! last_index Vs V"
             using len\<^sub>1 by(simp del:size_last_index_conv)
         }
         ultimately show ?thesis using Block_lem[OF rel\<^sub>1] len\<^sub>1  by simp
       qed
     qed
   qed
 next
   case Try thus ?case by(fastforce intro!:Try\<^sub>1)
 next
   case Throw thus ?case by(fastforce intro!:Throw\<^sub>1)
 next
   case ThrowNull thus ?case by(fastforce intro!:ThrowNull\<^sub>1)
 next
   case ThrowThrow thus ?case  by(fastforce intro!:ThrowThrow\<^sub>1)
 next
   case (CondT e h l sh h\<^sub>1 l\<^sub>1 sh\<^sub>1 e\<^sub>1 e' h\<^sub>2 l\<^sub>2 sh\<^sub>2 e\<^sub>2)
   have "PROP ?P e h l sh true h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with CondT.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh true h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"  by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 e' h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 CondT.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 e' h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 show ?case by(auto intro!:CondT\<^sub>1)
 next
   case (CondF e h l sh h\<^sub>1 l\<^sub>1 sh\<^sub>1 e\<^sub>2 e' h\<^sub>2 l\<^sub>2 sh\<^sub>2 e\<^sub>1 Vs ls)
   have "PROP ?P e h l sh false h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with CondF.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh false h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"  by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>2 h\<^sub>1 l\<^sub>1 sh\<^sub>1 e' h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 CondF.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>2 h\<^sub>1 l\<^sub>1 sh\<^sub>1 e' h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 show ?case by(auto intro!:CondF\<^sub>1)
 next
   case CondThrow thus ?case by(fastforce intro!:CondThrow\<^sub>1)
 next
   case (Seq e h l sh v h\<^sub>1 l\<^sub>1 sh\<^sub>1 e\<^sub>1 e' h\<^sub>2 l\<^sub>2 sh\<^sub>2)
   have "PROP ?P e h l sh (Val v) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with Seq.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh (Val v) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"  by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 e' h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 Seq.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 e' h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 Seq show ?case by(auto intro!:Seq\<^sub>1)
 next
   case SeqThrow thus ?case by(fastforce intro!:SeqThrow\<^sub>1)
 next
   case WhileF thus ?case by(fastforce intro!:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (WhileT e h l sh h\<^sub>1 l\<^sub>1 sh\<^sub>1 c v h\<^sub>2 l\<^sub>2 sh\<^sub>2 e' h\<^sub>3 l\<^sub>3 sh\<^sub>3)
   have "PROP ?P e h l sh true h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with WhileT.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh true h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"   by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P c h\<^sub>1 l\<^sub>1 sh\<^sub>1 (Val v) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 WhileT.prems
   obtain ls\<^sub>2 where 2: "?Post c h\<^sub>1 l\<^sub>1 sh\<^sub>1 (Val v) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"
     "size ls\<^sub>1 = size ls\<^sub>2"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P (While (e) c) h\<^sub>2 l\<^sub>2 sh\<^sub>2 e' h\<^sub>3 l\<^sub>3 sh\<^sub>3 Vs ls\<^sub>2" by fact
   with 1 2 WhileT.prems
   obtain ls\<^sub>3 where 3: "?Post (While (e) c) h\<^sub>2 l\<^sub>2 sh\<^sub>2 e' h\<^sub>3 l\<^sub>3 sh\<^sub>3 Vs ls\<^sub>2 ls\<^sub>3" by(auto)
   from 1 2 3 show ?case by(auto intro!:WhileT\<^sub>1)
 next
   case (WhileBodyThrow e h l sh h\<^sub>1 l\<^sub>1 sh\<^sub>1 c e' h\<^sub>2 l\<^sub>2 sh\<^sub>2)
   have "PROP ?P e h l sh true h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with WhileBodyThrow.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh true h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P c h\<^sub>1 l\<^sub>1 sh\<^sub>1 (throw e') h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 WhileBodyThrow.prems
   obtain ls\<^sub>2 where 2: "?Post c h\<^sub>1 l\<^sub>1 sh\<^sub>1 (throw e') h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2" by auto
   from 1 2 show ?case by(auto intro!:WhileBodyThrow\<^sub>1)
 next
   case WhileCondThrow thus ?case by(fastforce intro!:WhileCondThrow\<^sub>1)
 next
   case New thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case NewFail thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case NewInit then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case NewInitOOM then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case NewInitThrow then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case Cast thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case CastNull thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case CastThrow thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (CastFail e h l sh a h\<^sub>1 l\<^sub>1 sh\<^sub>1 D fs C)
   have "PROP ?P e h l sh (addr a) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with CastFail.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh (addr a) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1" by auto
   show ?case using 1 CastFail.hyps
     by(auto intro!:CastFail\<^sub>1[where D=D])
 next
   case Val thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (BinOp e h l sh v\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 e\<^sub>1 v\<^sub>2 h\<^sub>2 l\<^sub>2 sh\<^sub>2 bop v)
   have "PROP ?P e h l sh (Val v\<^sub>1) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with BinOp.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh (Val v\<^sub>1) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 (Val v\<^sub>2) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 BinOp.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 (Val v\<^sub>2) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 BinOp show ?case by(auto intro!:BinOp\<^sub>1)
 next
   case (BinOpThrow2 e\<^sub>0 h l sh v\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 e\<^sub>1 e h\<^sub>2 l\<^sub>2 sh\<^sub>2 bop)
   have "PROP ?P e\<^sub>0 h l sh (Val v\<^sub>1) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with BinOpThrow2.prems
   obtain ls\<^sub>1 where 1: "?Post e\<^sub>0 h l sh (Val v\<^sub>1) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 (throw e) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 BinOpThrow2.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 (throw e) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 BinOpThrow2 show ?case by(auto intro!:BinOpThrow\<^sub>2\<^sub>1)
 next
   case BinOpThrow1 thus ?case  by(fastforce intro!:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case Var thus ?case
     by(force intro!:Var\<^sub>1 simp add: map_le_def fun_upds_apply)
 next
   case LAss thus ?case
     by(fastforce simp add: LAss_lem intro:eval\<^sub>1_evals\<^sub>1.intros
                 dest:eval\<^sub>1_preserves_len)
 next
   case LAssThrow thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case FAcc thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case FAccNull thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case FAccThrow thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (FAccNone e h l sh a h' l' sh' C fs F D)
   have "PROP ?P e h l sh (addr a) h' l' sh' Vs ls" by fact
   with FAccNone.prems
   obtain ls\<^sub>2 where 2: "?Post e h l sh (addr a) h' l' sh' Vs ls ls\<^sub>2" by(auto)
   from 2 FAccNone show ?case by(rule_tac x = ls\<^sub>2 in exI, auto elim!: FAccNone\<^sub>1)
 next
   case (FAccStatic e h l sh a h' l' sh' C fs F t D)
   have "PROP ?P e h l sh (addr a) h' l' sh' Vs ls" by fact
   with FAccStatic.prems
   obtain ls\<^sub>2 where 2: "?Post e h l sh (addr a) h' l' sh' Vs ls ls\<^sub>2" by(auto)
   from 2 FAccStatic show ?case by(rule_tac x = ls\<^sub>2 in exI, auto elim!: FAccStatic\<^sub>1)
 next
   case SFAcc then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (SFAccInit C F t D sh h l v' h' l' sh' sfs i v)
   have "PROP ?P (INIT D ([D],False) \<leftarrow> unit) h l sh (Val v') h' l' sh' Vs ls" by fact
   with SFAccInit.prems
   obtain ls\<^sub>2 where 1: "?Post (INIT D ([D],False) \<leftarrow> unit) h l sh (Val v') h' l' sh' Vs ls ls\<^sub>2" by(auto)
   from 1 SFAccInit show ?case by(rule_tac x = ls\<^sub>2 in exI, auto intro: SFAccInit\<^sub>1)
 next
   case (SFAccInitThrow C F t D sh h l a h' l' sh')
   have "PROP ?P (INIT D ([D],False) \<leftarrow> unit) h l sh (throw a) h' l' sh' Vs ls" by fact
   with SFAccInitThrow.prems
   obtain ls\<^sub>2 where 1: "?Post (INIT D ([D],False) \<leftarrow> unit) h l sh (throw a) h' l' sh' Vs ls ls\<^sub>2" by(auto)
   from 1 SFAccInitThrow show ?case by(rule_tac x = ls\<^sub>2 in exI, auto intro: SFAccInitThrow\<^sub>1)
 next
   case SFAccNone then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case SFAccNonStatic then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (FAss e\<^sub>1 h l sh a h\<^sub>1 l\<^sub>1 sh\<^sub>1 e\<^sub>2 v h\<^sub>2 l\<^sub>2 sh\<^sub>2 C fs fs' F D h\<^sub>2')
   have "PROP ?P e\<^sub>1 h l sh (addr a) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with FAss.prems
   obtain ls\<^sub>1 where 1: "?Post e\<^sub>1 h l sh (addr a) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>2 h\<^sub>1 l\<^sub>1 sh\<^sub>1 (Val v) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 FAss.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>2 h\<^sub>1 l\<^sub>1 sh\<^sub>1 (Val v) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 FAss show ?case by(auto intro!:FAss\<^sub>1)
 next
   case (FAssNull e\<^sub>1 h l sh h\<^sub>1 l\<^sub>1 sh\<^sub>1 e\<^sub>2 v h\<^sub>2 l\<^sub>2 sh\<^sub>2 F D)
   have "PROP ?P e\<^sub>1 h l sh null h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with FAssNull.prems
   obtain ls\<^sub>1 where 1: "?Post e\<^sub>1 h l sh null h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>2 h\<^sub>1 l\<^sub>1 sh\<^sub>1 (Val v) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 FAssNull.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>2 h\<^sub>1 l\<^sub>1 sh\<^sub>1 (Val v) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2" by(auto)
   from 1 2 FAssNull show ?case by(auto intro!:FAssNull\<^sub>1)
 next
   case FAssThrow1 thus ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (FAssThrow2 e\<^sub>1 h l sh v h\<^sub>1 l\<^sub>1 sh\<^sub>1 e\<^sub>2 e h\<^sub>2 l\<^sub>2 sh\<^sub>2 F D)
   have "PROP ?P e\<^sub>1 h l sh (Val v) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with FAssThrow2.prems
   obtain ls\<^sub>1 where 1: "?Post e\<^sub>1 h l sh (Val v) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"   by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>2 h\<^sub>1 l\<^sub>1 sh\<^sub>1 (throw e) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 FAssThrow2.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>2 h\<^sub>1 l\<^sub>1 sh\<^sub>1 (throw e) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 FAssThrow2 show ?case by(auto intro!:FAssThrow\<^sub>2\<^sub>1)
 next
   case (FAssNone e\<^sub>1 h l sh a h' l' sh' e\<^sub>2 v h\<^sub>2 l\<^sub>2 sh\<^sub>2 C fs F D)
   have "PROP ?P e\<^sub>1 h l sh (addr a) h' l' sh' Vs ls" by fact
   with FAssNone.prems
   obtain ls\<^sub>1 where 1: "?Post e\<^sub>1 h l sh (addr a) h' l' sh' Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"   by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>2 h' l' sh' (Val v) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 FAssNone.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>2 h' l' sh' (Val v) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 FAssNone show ?case by(auto intro!:FAssNone\<^sub>1)
 next
   case (FAssStatic e\<^sub>1 h l sh a h' l' sh' e\<^sub>2 v h\<^sub>2 l\<^sub>2 sh\<^sub>2 C fs F t D)
   have "PROP ?P e\<^sub>1 h l sh (addr a) h' l' sh' Vs ls" by fact
   with FAssStatic.prems
   obtain ls\<^sub>1 where 1: "?Post e\<^sub>1 h l sh (addr a) h' l' sh' Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"   by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P e\<^sub>2 h' l' sh' (Val v) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 FAssStatic.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>2 h' l' sh' (Val v) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"  by(auto)
   from 1 2 FAssStatic show ?case by(auto intro!:FAssStatic\<^sub>1)
 next
   case SFAss then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (SFAssInit e\<^sub>2 h l sh v h\<^sub>1 l\<^sub>1 sh\<^sub>1 C F t D v' h' l' sh' sfs i sfs' sh'')
   have "PROP ?P e\<^sub>2 h l sh (Val v) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with SFAssInit.prems
   obtain ls\<^sub>1 where 1: "?Post e\<^sub>2 h l sh (Val v) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1" "length ls = length ls\<^sub>1"
     by(auto intro!:eval\<^sub>1_preserves_len)
   then have Init_size: "length Vs \<le> length ls\<^sub>1" using SFAssInit.prems(3) by linarith
   have "PROP ?P (INIT D ([D],False) \<leftarrow> unit) h\<^sub>1 l\<^sub>1 sh\<^sub>1 (Val v') h' l' sh' Vs ls\<^sub>1" by fact
   with 1 Init_size SFAssInit.prems
   obtain ls\<^sub>2 where 2: "?Post (INIT D ([D],False) \<leftarrow> unit) h\<^sub>1 l\<^sub>1 sh\<^sub>1 (Val v') h' l' sh' Vs ls\<^sub>1 ls\<^sub>2"
     by auto
   from 1 2 SFAssInit show ?case
     by(auto simp add: comp_def
                 intro!: SFAssInit\<^sub>1 dest!:evals_final)
 next
   case (SFAssInitThrow e\<^sub>2 h l sh v h\<^sub>1 l\<^sub>1 sh\<^sub>1 C F t D a h\<^sub>2 l\<^sub>2 sh\<^sub>2)
   have "PROP ?P e\<^sub>2 h l sh (Val v) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with SFAssInitThrow.prems
   obtain ls\<^sub>1 where 1: "?Post e\<^sub>2 h l sh (Val v) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1" "length ls = length ls\<^sub>1"
     by(auto intro!:eval\<^sub>1_preserves_len)
   then have Init_size: "length Vs \<le> length ls\<^sub>1" using SFAssInitThrow.prems(3) by linarith
   have "PROP ?P (INIT D ([D],False) \<leftarrow> unit) h\<^sub>1 l\<^sub>1 sh\<^sub>1 (throw a) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 Init_size SFAssInitThrow.prems
   obtain ls\<^sub>2 where 2: "?Post (INIT D ([D],False) \<leftarrow> unit) h\<^sub>1 l\<^sub>1 sh\<^sub>1 (throw a) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"
     by auto
   from 1 2 SFAssInitThrow show ?case
     by(auto simp add: comp_def
                 intro!: SFAssInitThrow\<^sub>1 dest!:evals_final)
 next
   case SFAssThrow then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (SFAssNone e\<^sub>2 h l sh v h\<^sub>2 l\<^sub>2 sh\<^sub>2 C F D)
   have "PROP ?P e\<^sub>2 h l sh (Val v) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls" by fact
   with SFAssNone.prems
   obtain ls\<^sub>2 where 2: "?Post e\<^sub>2 h l sh (Val v) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls ls\<^sub>2" by(auto)
   from 2 SFAssNone show ?case by(rule_tac x = ls\<^sub>2 in exI, auto elim!: SFAssNone\<^sub>1)
 next
   case SFAssNonStatic then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (CallNull e h l sh h\<^sub>1 l\<^sub>1 sh\<^sub>1 es vs h\<^sub>2 l\<^sub>2 sh\<^sub>2 M)
   have "PROP ?P e h l sh null h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with CallNull.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh null h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?Ps es h\<^sub>1 l\<^sub>1 sh\<^sub>1 (map Val vs) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 CallNull.prems
   obtain ls\<^sub>2 where 2: "?Posts es h\<^sub>1 l\<^sub>1 sh\<^sub>1 (map Val vs) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2" by(auto)
   from 1 2 CallNull show ?case
     by (auto simp add: comp_def elim!: CallNull\<^sub>1)
 next
   case CallObjThrow thus ?case  by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (CallParamsThrow e h l sh v h\<^sub>1 l\<^sub>1 sh\<^sub>1 es vs ex es' h\<^sub>2 l\<^sub>2 sh\<^sub>2 M)
   have "PROP ?P e h l sh (Val v) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with CallParamsThrow.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh (Val v) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?Ps es h\<^sub>1 l\<^sub>1 sh\<^sub>1 (map Val vs @ throw ex # es') h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 CallParamsThrow.prems
   obtain ls\<^sub>2 where 2: "?Posts es h\<^sub>1 l\<^sub>1 sh\<^sub>1 (map Val vs @ throw ex # es') h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2" by(auto)
   from 1 2 CallParamsThrow show ?case
     by (auto simp add: comp_def
              elim!: CallParamsThrow\<^sub>1 dest!:evals_final)
 next
   case (CallNone e h l sh a h\<^sub>1 l\<^sub>1 sh\<^sub>1 ps vs h\<^sub>2 l\<^sub>2 sh\<^sub>2 C fs M)
   have "PROP ?P e h l sh (addr a) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with CallNone.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh (addr a) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?Ps ps h\<^sub>1 l\<^sub>1 sh\<^sub>1 (map Val vs) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 CallNone.prems
   obtain ls\<^sub>2 where 2: "?Posts ps h\<^sub>1 l\<^sub>1 sh\<^sub>1 (map Val vs) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2" by(auto)
   from 1 2 CallNone show ?case
     by (auto simp add: comp_def
              elim!: CallNone\<^sub>1 dest!:evals_final sees_method_compPD)
 next
   case (CallStatic e h l sh a h\<^sub>1 l\<^sub>1 sh\<^sub>1 ps vs h\<^sub>2 l\<^sub>2 sh\<^sub>2 C fs M Ts T pns body D)
   have "PROP ?P e h l sh (addr a) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with CallStatic.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh (addr a) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   let ?Vs = pns
   have mdecl: "P \<turnstile> C sees M,Static: Ts\<rightarrow>T = (pns, body) in D" by fact
   have mdecl\<^sub>1: "compP\<^sub>1 P \<turnstile> C sees M,Static: Ts\<rightarrow>T = (compE\<^sub>1 ?Vs body) in D"
     using sees_method_compP[OF mdecl, of "\<lambda>b (pns,e). compE\<^sub>1 (case b of NonStatic \<Rightarrow> this#pns | Static \<Rightarrow> pns) e"]
     by(simp)
   have "PROP ?Ps ps h\<^sub>1 l\<^sub>1 sh\<^sub>1 (map Val vs) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 CallStatic.prems
   obtain ls\<^sub>2 where 2: "?Posts ps h\<^sub>1 l\<^sub>1 sh\<^sub>1 (map Val vs) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2" by(auto)
   from 1 2 mdecl\<^sub>1 CallStatic show ?case
     by (auto simp add: comp_def
              elim!: CallStatic\<^sub>1 dest!:evals_final)
 next
   case (Call e h l sh a h\<^sub>1 l\<^sub>1 sh\<^sub>1 es vs h\<^sub>2 l\<^sub>2 sh\<^sub>2 C fs M Ts T pns body D l\<^sub>2' b' h\<^sub>3 l\<^sub>3 sh\<^sub>3)
   have "PROP ?P e h l sh (addr a) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with Call.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh (addr a) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?Ps es h\<^sub>1 l\<^sub>1 sh\<^sub>1 (map Val vs) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 Call.prems
   obtain ls\<^sub>2 where 2: "?Posts es h\<^sub>1 l\<^sub>1 sh\<^sub>1 (map Val vs) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"
     "size ls\<^sub>1 = size ls\<^sub>2"    by(auto intro!:evals\<^sub>1_preserves_len)
   let ?Vs = "this#pns"
   let ?ls = "Addr a # vs @ replicate (max_vars body) undefined"
   have mdecl: "P \<turnstile> C sees M,NonStatic: Ts\<rightarrow>T = (pns, body) in D" by fact
   have fv_body: "fv body \<subseteq> set ?Vs" and wf_size: "size Ts = size pns"
     using wf mdecl by(auto dest!:sees_wf_mdecl simp:wf_mdecl_def)
   have mdecl\<^sub>1: "compP\<^sub>1 P \<turnstile> C sees M,NonStatic: Ts\<rightarrow>T = (compE\<^sub>1 ?Vs body) in D"
     using sees_method_compP[OF mdecl, of "\<lambda>b (pns,e). compE\<^sub>1 (case b of NonStatic \<Rightarrow> this#pns | Static \<Rightarrow> pns) e"]
     by(simp)
   have [simp]: "l\<^sub>2' = [this \<mapsto> Addr a, pns [\<mapsto>] vs]" by fact
   have Call_size: "size vs = size pns" by fact
   have "PROP ?P body h\<^sub>2 l\<^sub>2' sh\<^sub>2 b' h\<^sub>3 l\<^sub>3 sh\<^sub>3 ?Vs ?ls" by fact
   with 1 2 fv_body Call_size Call.prems
   obtain ls\<^sub>3 where 3: "?Post body h\<^sub>2 l\<^sub>2' sh\<^sub>2 b' h\<^sub>3 l\<^sub>3 sh\<^sub>3 ?Vs ?ls ls\<^sub>3"  by(auto)
   have hp: "h\<^sub>2 a = Some (C, fs)" by fact
   from 1 2 3 hp mdecl\<^sub>1 wf_size Call_size show ?case
     by(fastforce simp add: comp_def
                 intro!: Call\<^sub>1 dest!:evals_final)
 next
   case (SCallParamsThrow es h l sh vs ex es' h\<^sub>2 l\<^sub>2 sh\<^sub>2 C M)
   have "PROP ?Ps es h l sh (map Val vs @ throw ex # es') h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls" by fact
   with SCallParamsThrow.prems
   obtain ls\<^sub>2 where 2: "?Posts es h l sh (map Val vs @ throw ex # es') h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls ls\<^sub>2" by(auto)
   from 2 SCallParamsThrow show ?case
     by (fastforce simp add: comp_def
              elim!: SCallParamsThrow\<^sub>1 dest!:evals_final)
 next
   case (SCall ps h l sh vs h\<^sub>2 l\<^sub>2 sh\<^sub>2 C M Ts T pns body D sfs l\<^sub>2' e' h\<^sub>3 l\<^sub>3 sh\<^sub>3)
   have "PROP ?Ps ps h l sh (map Val vs) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls" by fact
   with SCall.prems
   obtain ls\<^sub>2 where 2: "?Posts ps h l sh (map Val vs) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls ls\<^sub>2"
     "size ls = size ls\<^sub>2"    by(auto intro!:evals\<^sub>1_preserves_len)
   let ?Vs = "pns"
   let ?ls = "vs @ replicate (max_vars body) undefined"
   have mdecl: "P \<turnstile> C sees M,Static: Ts\<rightarrow>T = (pns, body) in D" by fact
   have fv_body: "fv body \<subseteq> set ?Vs" and wf_size: "size Ts = size pns"
     using wf mdecl by(auto dest!:sees_wf_mdecl simp:wf_mdecl_def)
   have mdecl\<^sub>1: "compP\<^sub>1 P \<turnstile> C sees M,Static: Ts\<rightarrow>T = (compE\<^sub>1 ?Vs body) in D"
     using sees_method_compP[OF mdecl, of "\<lambda>b (pns,e). compE\<^sub>1 (case b of NonStatic \<Rightarrow> this#pns | Static \<Rightarrow> pns) e"]
     by(simp)
   have [simp]: "l\<^sub>2' = [pns [\<mapsto>] vs]" by fact
   have SCall_size: "size vs = size pns" by fact
   have "PROP ?P body h\<^sub>2 l\<^sub>2' sh\<^sub>2 e' h\<^sub>3 l\<^sub>3 sh\<^sub>3 ?Vs ?ls" by fact
   with 2 fv_body SCall_size SCall.prems
   obtain ls\<^sub>3 where 3: "?Post body h\<^sub>2 l\<^sub>2' sh\<^sub>2 e' h\<^sub>3 l\<^sub>3 sh\<^sub>3 ?Vs ?ls ls\<^sub>3"  by(auto)
   have shp: "sh\<^sub>2 D = \<lfloor>(sfs, Done)\<rfloor> \<or> M = clinit \<and> sh\<^sub>2 D = \<lfloor>(sfs, Processing)\<rfloor>" by fact
   from 2 3 shp mdecl\<^sub>1 wf_size SCall_size show ?case
     by(fastforce simp add: comp_def
                 intro!: SCall\<^sub>1 dest!:evals_final)
 next
   case (SCallNone ps h l sh vs h' l' sh' C M)
   have "PROP ?Ps ps h l sh (map Val vs) h' l' sh' Vs ls" by fact
   with SCallNone.prems
   obtain ls\<^sub>2 where 2: "?Posts ps h l sh (map Val vs) h' l' sh' Vs ls ls\<^sub>2" by(auto)
   from 2 SCallNone show ?case
     by(rule_tac x = ls\<^sub>2 in exI,
        auto simp add: comp_def elim!: SCallNone\<^sub>1 dest!:evals_final sees_method_compPD)
 next
   case (SCallNonStatic ps h l sh vs h' l' sh' C M Ts T pns body D)
   let ?Vs = "this#pns"
   have mdecl: "P \<turnstile> C sees M,NonStatic: Ts\<rightarrow>T = (pns, body) in D" by fact
   have mdecl\<^sub>1: "compP\<^sub>1 P \<turnstile> C sees M,NonStatic: Ts\<rightarrow>T = (compE\<^sub>1 ?Vs body) in D"
     using sees_method_compP[OF mdecl, of "\<lambda>b (pns,e). compE\<^sub>1 (case b of NonStatic \<Rightarrow> this#pns | Static \<Rightarrow> pns) e"]
     by(simp)
   have "PROP ?Ps ps h l sh (map Val vs) h' l' sh' Vs ls" by fact
   with SCallNonStatic.prems
   obtain ls\<^sub>2 where 2: "?Posts ps h l sh (map Val vs) h' l' sh' Vs ls ls\<^sub>2" by(auto)
   from 2 mdecl\<^sub>1 SCallNonStatic show ?case
     by (auto simp add: comp_def
              elim!: SCallNonStatic\<^sub>1 dest!:evals_final)
 next
   case (SCallInitThrow ps h l sh vs h\<^sub>1 l\<^sub>1 sh\<^sub>1 C M Ts T pns body D a h\<^sub>2 l\<^sub>2 sh\<^sub>2)
   have "PROP ?Ps ps h l sh (map Val vs) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with SCallInitThrow.prems
   obtain ls\<^sub>1 where 1: "?Posts ps h l sh (map Val vs) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1" "length ls = length ls\<^sub>1"
     by(auto intro!:evals\<^sub>1_preserves_len)
   then have Init_size: "length Vs \<le> length ls\<^sub>1" using SCallInitThrow.prems(3) by linarith
   have "PROP ?P (INIT D ([D],False) \<leftarrow> unit) h\<^sub>1 l\<^sub>1 sh\<^sub>1 (throw a) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 Init_size SCallInitThrow.prems
   obtain ls\<^sub>2 where 2: "?Post (INIT D ([D],False) \<leftarrow> unit) h\<^sub>1 l\<^sub>1 sh\<^sub>1 (throw a) h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"
     by auto
   let ?Vs = "pns"
   have mdecl: "P \<turnstile> C sees M,Static: Ts\<rightarrow>T = (pns, body) in D" by fact
   have mdecl\<^sub>1: "compP\<^sub>1 P \<turnstile> C sees M,Static: Ts\<rightarrow>T = (compE\<^sub>1 ?Vs body) in D"
     using sees_method_compP[OF mdecl, of "\<lambda>b (pns,e). compE\<^sub>1 (case b of NonStatic \<Rightarrow> this#pns | Static \<Rightarrow> pns) e"]
     by(simp)
   from 1 2 mdecl\<^sub>1 SCallInitThrow show ?case
     by(auto simp add: comp_def
                 intro!: SCallInitThrow\<^sub>1 dest!:evals_final)
 next
   case (SCallInit ps h l sh vs h\<^sub>1 l\<^sub>1 sh\<^sub>1 C M Ts T pns body D v' h\<^sub>2 l\<^sub>2 sh\<^sub>2 l\<^sub>2' e' h\<^sub>3 l\<^sub>3 sh\<^sub>3)
   have "PROP ?Ps ps h l sh (map Val vs) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls" by fact
   with SCallInit.prems
   obtain ls\<^sub>1 where 1: "?Posts ps h l sh (map Val vs) h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls ls\<^sub>1" "length ls = length ls\<^sub>1"
     by(auto intro!:evals\<^sub>1_preserves_len)
   then have Init_size: "length Vs \<le> length ls\<^sub>1" using SCallInit.prems(3) by linarith
   have "PROP ?P (INIT D ([D],False) \<leftarrow> unit) h\<^sub>1 l\<^sub>1 sh\<^sub>1 (Val v') h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1" by fact
   with 1 Init_size SCallInit.prems
   obtain ls\<^sub>2 where 2: "?Post (INIT D ([D],False) \<leftarrow> unit) h\<^sub>1 l\<^sub>1 sh\<^sub>1 (Val v') h\<^sub>2 l\<^sub>2 sh\<^sub>2 Vs ls\<^sub>1 ls\<^sub>2"
     by auto
   let ?Vs = "pns"
   let ?ls = "vs @ replicate (max_vars body) undefined"
   have mdecl: "P \<turnstile> C sees M,Static: Ts\<rightarrow>T = (pns, body) in D" by fact
   have fv_body: "fv body \<subseteq> set ?Vs" and wf_size: "size Ts = size pns"
     using wf mdecl by(auto dest!:sees_wf_mdecl simp:wf_mdecl_def)
   have mdecl\<^sub>1: "compP\<^sub>1 P \<turnstile> C sees M,Static: Ts\<rightarrow>T = (compE\<^sub>1 ?Vs body) in D"
     using sees_method_compP[OF mdecl, of "\<lambda>b (pns,e). compE\<^sub>1 (case b of NonStatic \<Rightarrow> this#pns | Static \<Rightarrow> pns) e"]
     by(simp)
   have [simp]: "l\<^sub>2' = [pns [\<mapsto>] vs]" by fact
   have SCall_size: "size vs = size pns" by fact
   have nclinit: "M \<noteq> clinit" by fact
   have "PROP ?P body h\<^sub>2 l\<^sub>2' sh\<^sub>2 e' h\<^sub>3 l\<^sub>3 sh\<^sub>3 ?Vs ?ls" by fact
   with 2 fv_body SCall_size SCallInit.prems
   obtain ls\<^sub>3 where 3: "?Post body h\<^sub>2 l\<^sub>2' sh\<^sub>2 e' h\<^sub>3 l\<^sub>3 sh\<^sub>3 ?Vs ?ls ls\<^sub>3"  by(auto)
   have shp: "\<nexists>sfs. sh\<^sub>1 D = \<lfloor>(sfs, Done)\<rfloor>" by fact
   from 1 2 3 shp mdecl\<^sub>1 wf_size SCall_size nclinit show ?case
     by(auto simp add: comp_def
                 intro!: SCallInit\<^sub>1 dest!:evals_final)
 next
 \<comment> \<open> init cases \<close>
   case InitFinal then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (InitNone sh C C' Cs e h l e' h' l' sh')
   let ?sh1 = "sh(C \<mapsto> (sblank P C, Prepared))"
   have "PROP ?P (INIT C' (C # Cs,False) \<leftarrow> e) h l ?sh1 e' h' l' sh' Vs ls" by fact
   with InitNone.prems
   obtain ls\<^sub>2 where 2: "?Post (INIT C' (C # Cs,False) \<leftarrow> e) h l ?sh1 e' h' l' sh' Vs ls ls\<^sub>2" by(auto)
   from 2 InitNone show ?case by (auto elim!: InitNone\<^sub>1)
 next
   case InitDone then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case InitProcessing then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case InitError then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case InitObject then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (InitNonObject sh C sfs D fs ms sh' C' Cs e h l e' h1 l1 sh1)
   let ?f = "(\<lambda>b (pns,body). compE\<^sub>1 (case b of NonStatic \<Rightarrow> this#pns | Static \<Rightarrow> pns) body)"
   have cls: "class (compP ?f P) C = \<lfloor>(D,fs,map (compM ?f) ms)\<rfloor>"
     by(rule class_compP[OF InitNonObject.hyps(3)])
   have "PROP ?P (INIT C' (D # C # Cs,False) \<leftarrow> e) h l sh' e' h1 l1 sh1 Vs ls" by fact
   with InitNonObject.prems
   obtain ls\<^sub>2 where 2: "?Post (INIT C' (D # C # Cs,False) \<leftarrow> e) h l sh' e' h1 l1 sh1 Vs ls ls\<^sub>2" by(auto)
   from 2 cls InitNonObject show ?case by (auto elim!: InitNonObject\<^sub>1)
 next
   case InitRInit then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 next
   case (RInit e h l sh v h' l' sh' C sfs i sh'' C' Cs e' e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1)
   have "PROP ?P e h l sh (Val v) h' l' sh' Vs ls" by fact
   with RInit.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh (Val v) h' l' sh' Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have "PROP ?P (INIT C' (Cs,True) \<leftarrow> e') h' l' sh'' e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls\<^sub>1" by fact
   with 1 RInit.prems
   obtain ls\<^sub>2 where 2: "?Post (INIT C' (Cs,True) \<leftarrow> e') h' l' sh'' e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls\<^sub>1 ls\<^sub>2" by(auto)
   from 1 2 RInit show ?case by (auto elim!: RInit\<^sub>1)
 next
   case (RInitInitFail e h l sh a h' l' sh' C sfs i sh'' D Cs e' e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1)
   have "PROP ?P e h l sh (throw a) h' l' sh' Vs ls" by fact
   with RInitInitFail.prems
   obtain ls\<^sub>1 where 1: "?Post e h l sh (throw a) h' l' sh' Vs ls ls\<^sub>1"
     "size ls = size ls\<^sub>1"    by(auto intro!:eval\<^sub>1_preserves_len)
   have fv: "fv (RI (D,throw a) ; Cs \<leftarrow> e') \<subseteq> set Vs"
     using RInitInitFail.hyps(1) eval_final RInitInitFail.prems(1) subset_eq by fastforce
   have l': "l' \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>1]" by (simp add: "1"(1))
   have "PROP ?P (RI (D,throw a) ; Cs \<leftarrow> e') h' l' sh'' e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls\<^sub>1" by fact
   with 1 eval_final[OF RInitInitFail.hyps(1)] RInitInitFail.prems
   obtain ls\<^sub>2 where 2: "?Post (RI (D,throw a) ; Cs \<leftarrow> e') h' l' sh'' e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 Vs ls\<^sub>1 ls\<^sub>2"
     by fastforce
   from 1 2 RInitInitFail show ?case
     by(fastforce simp add: comp_def
                 intro!: RInitInitFail\<^sub>1 dest!:eval_final)
 next
   case RInitFailFinal then show ?case by(fastforce intro:eval\<^sub>1_evals\<^sub>1.intros)
 qed
 (*>*)
 
 
 subsection\<open>Preservation of well-formedness\<close>
 
 text\<open> The compiler preserves well-formedness. Is less trivial than it
 may appear. We start with two simple properties: preservation of
 well-typedness \<close>
 
 lemma compE\<^sub>1_pres_wt: "\<And>Vs Ts U.
   \<lbrakk> P,[Vs[\<mapsto>]Ts] \<turnstile> e :: U; size Ts = size Vs \<rbrakk>
   \<Longrightarrow> compP f P,Ts \<turnstile>\<^sub>1 compE\<^sub>1 Vs e :: U"
 and  "\<And>Vs Ts Us.
   \<lbrakk> P,[Vs[\<mapsto>]Ts] \<turnstile> es [::] Us; size Ts = size Vs \<rbrakk>
   \<Longrightarrow> compP f P,Ts \<turnstile>\<^sub>1 compEs\<^sub>1 Vs es [::] Us"
 (*<*)
-apply(induct e and es rule: compE\<^sub>1.induct compEs\<^sub>1.induct)
-apply clarsimp
-apply(fastforce)
-apply clarsimp
-apply(fastforce split:bop.splits)
-apply (fastforce simp:map_upds_apply_eq_Some split:if_split_asm)
-apply (fastforce simp:map_upds_apply_eq_Some split:if_split_asm)
-apply(fastforce)
-apply(fastforce)
-apply(fastforce)
-apply(fastforce)
-apply (fastforce dest!: sees_method_compP[where f = f])
-apply (fastforce dest!: sees_method_compP[where f = f])
-apply (fastforce simp:nth_append)
-apply (fastforce)
-apply (fastforce)
-apply (fastforce)
-apply (fastforce)
-apply (fastforce simp:nth_append)
-apply simp
-apply simp
-apply simp
-apply (fastforce)
-done
+proof(induct e and es rule: compE\<^sub>1.induct compEs\<^sub>1.induct)
+  case Var then show ?case
+    by (fastforce simp:map_upds_apply_eq_Some split:if_split_asm)
+next
+  case LAss then show ?case
+    by (fastforce simp:map_upds_apply_eq_Some split:if_split_asm)
+next
+  case Call then show ?case
+    by (fastforce dest!: sees_method_compP[where f = f])
+next
+  case SCall then show ?case
+    by (fastforce dest!: sees_method_compP[where f = f])
+next
+  case Block then show ?case by (fastforce simp:nth_append)
+next
+  case TryCatch then show ?case by (fastforce simp:nth_append)
+qed fastforce+
 (*>*)
 
 text\<open>\noindent and the correct block numbering: \<close>
 
 lemma \<B>: "\<And>Vs n. size Vs = n \<Longrightarrow> \<B> (compE\<^sub>1 Vs e) n"
 and \<B>s: "\<And>Vs n. size Vs = n \<Longrightarrow> \<B>s (compEs\<^sub>1 Vs es) n"
 (*<*)by (induct e and es rule: \<B>.induct \<B>s.induct)
         (force | simp,metis length_append_singleton)+(*>*)
 
 text\<open> The main complication is preservation of definite assignment
 @{term"\<D>"}. \<close>
 
 lemma image_last_index: "A \<subseteq> set(xs@[x]) \<Longrightarrow> last_index (xs @ [x]) ` A =
   (if x \<in> A then insert (size xs) (last_index xs ` (A-{x})) else last_index xs ` A)"
 (*<*)
 by(auto simp:image_def)
 (*>*)
 
 
 lemma A_compE\<^sub>1_None[simp]:
       "\<And>Vs. \<A> e = None \<Longrightarrow> \<A> (compE\<^sub>1 Vs e) = None"
 and "\<And>Vs. \<A>s es = None \<Longrightarrow> \<A>s (compEs\<^sub>1 Vs es) = None"
 (*<*)by(induct e and es rule: compE\<^sub>1.induct compEs\<^sub>1.induct)(auto simp:hyperset_defs)(*>*)
 
 
 lemma A_compE\<^sub>1:
       "\<And>A Vs. \<lbrakk> \<A> e = \<lfloor>A\<rfloor>; fv e \<subseteq> set Vs \<rbrakk> \<Longrightarrow> \<A> (compE\<^sub>1 Vs e) = \<lfloor>last_index Vs ` A\<rfloor>"
 and "\<And>A Vs. \<lbrakk> \<A>s es = \<lfloor>A\<rfloor>; fvs es \<subseteq> set Vs \<rbrakk> \<Longrightarrow> \<A>s (compEs\<^sub>1 Vs es) = \<lfloor>last_index Vs ` A\<rfloor>"
 (*<*)
 proof(induct e and es rule: fv.induct fvs.induct)
   case (Block V' T e)
   hence "fv e \<subseteq> set (Vs@[V'])" by fastforce
   moreover obtain B where "\<A> e = \<lfloor>B\<rfloor>"
     using Block.prems by(simp add: hyperset_defs)
   moreover from calculation have "B \<subseteq> set (Vs@[V'])" by(auto dest!:A_fv)
   ultimately show ?case using Block
     by(auto simp add: hyperset_defs image_last_index last_index_size_conv)
 next
   case (TryCatch e\<^sub>1 C V' e\<^sub>2)
   hence fve\<^sub>2: "fv e\<^sub>2 \<subseteq> set (Vs@[V'])" by auto
   show ?case
   proof (cases "\<A> e\<^sub>1")
     assume A\<^sub>1: "\<A> e\<^sub>1 = None"
     then obtain A\<^sub>2 where A\<^sub>2: "\<A> e\<^sub>2 = \<lfloor>A\<^sub>2\<rfloor>" using TryCatch
       by(simp add:hyperset_defs)
     hence "A\<^sub>2 \<subseteq> set (Vs@[V'])" using TryCatch.prems A_fv[OF A\<^sub>2] by simp blast
     thus ?thesis using TryCatch fve\<^sub>2 A\<^sub>1 A\<^sub>2
       by(auto simp add:hyperset_defs image_last_index last_index_size_conv)
   next
     fix A\<^sub>1 assume A\<^sub>1: "\<A> e\<^sub>1 =  \<lfloor>A\<^sub>1\<rfloor>"
     show ?thesis
     proof (cases  "\<A> e\<^sub>2")
       assume A\<^sub>2: "\<A> e\<^sub>2 = None"
       then show ?case using TryCatch A\<^sub>1 by(simp add:hyperset_defs)
     next
       fix A\<^sub>2 assume A\<^sub>2: "\<A> e\<^sub>2 = \<lfloor>A\<^sub>2\<rfloor>"
       have "A\<^sub>1 \<subseteq> set Vs" using TryCatch.prems A_fv[OF A\<^sub>1] by simp blast
       moreover
       have "A\<^sub>2 \<subseteq> set (Vs@[V'])" using TryCatch.prems A_fv[OF A\<^sub>2] by simp blast
       ultimately show ?thesis using TryCatch A\<^sub>1 A\<^sub>2
         by (auto simp add: Diff_subset_conv last_index_size_conv subsetD hyperset_defs
                  dest!: sym [of _ A])
     qed
   qed
 next
   case (Cond e e\<^sub>1 e\<^sub>2)
   { assume "\<A> e = None \<or> \<A> e\<^sub>1 = None \<or> \<A> e\<^sub>2 = None"
     hence ?case using Cond by(auto simp add:hyperset_defs image_Un)
   }
   moreover
   { fix A A\<^sub>1 A\<^sub>2
     assume "\<A> e = \<lfloor>A\<rfloor>" and A\<^sub>1: "\<A> e\<^sub>1 = \<lfloor>A\<^sub>1\<rfloor>" and A\<^sub>2: "\<A> e\<^sub>2 = \<lfloor>A\<^sub>2\<rfloor>"
     moreover
     have "A\<^sub>1 \<subseteq> set Vs" using Cond.prems A_fv[OF A\<^sub>1] by simp blast
     moreover
     have "A\<^sub>2 \<subseteq> set Vs" using Cond.prems A_fv[OF A\<^sub>2] by simp blast
     ultimately have ?case using Cond
       by(auto simp add:hyperset_defs image_Un
           inj_on_image_Int[OF inj_on_last_index])
   }
   ultimately show ?case by fastforce
 qed (auto simp add:hyperset_defs)
 (*>*)
 
 
 lemma D_None[iff]: "\<D> (e::'a exp) None" and [iff]: "\<D>s (es::'a exp list) None"
 (*<*)by(induct e and es rule: \<D>.induct \<D>s.induct)(simp_all)(*>*)
 
 
 lemma D_last_index_compE\<^sub>1:
       "\<And>A Vs. \<lbrakk> A \<subseteq> set Vs; fv e \<subseteq> set Vs \<rbrakk> \<Longrightarrow>
                 \<D> e \<lfloor>A\<rfloor> \<Longrightarrow> \<D> (compE\<^sub>1 Vs e) \<lfloor>last_index Vs ` A\<rfloor>"
 and "\<And>A Vs. \<lbrakk> A \<subseteq> set Vs; fvs es \<subseteq> set Vs \<rbrakk> \<Longrightarrow>
                 \<D>s es \<lfloor>A\<rfloor> \<Longrightarrow> \<D>s (compEs\<^sub>1 Vs es) \<lfloor>last_index Vs ` A\<rfloor>"
 (*<*)
 proof(induct e and es rule: \<D>.induct \<D>s.induct)
   case (BinOp e\<^sub>1 bop e\<^sub>2)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e\<^sub>1")
     case None thus ?thesis using BinOp by simp
   next
     case (Some A\<^sub>1)
     have indexA\<^sub>1: "\<A> (compE\<^sub>1 Vs e\<^sub>1) = \<lfloor>last_index Vs ` A\<^sub>1\<rfloor>"
       using A_compE\<^sub>1[OF Some] BinOp.prems  by auto
     have "A \<union> A\<^sub>1 \<subseteq> set Vs" using BinOp.prems A_fv[OF Some] by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` (A \<union> A\<^sub>1)\<rfloor>" using BinOp Some by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` A \<union> last_index Vs ` A\<^sub>1\<rfloor>"
       by(simp add: image_Un)
     thus ?thesis using IH\<^sub>1 indexA\<^sub>1 by auto
   qed
 next
   case (FAss e\<^sub>1 F D e\<^sub>2)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e\<^sub>1")
     case None thus ?thesis using FAss by simp
   next
     case (Some A\<^sub>1)
     have indexA\<^sub>1: "\<A> (compE\<^sub>1 Vs e\<^sub>1) = \<lfloor>last_index Vs ` A\<^sub>1\<rfloor>"
       using A_compE\<^sub>1[OF Some] FAss.prems  by auto
     have "A \<union> A\<^sub>1 \<subseteq> set Vs" using FAss.prems A_fv[OF Some] by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` (A \<union> A\<^sub>1)\<rfloor>" using FAss Some by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` A \<union> last_index Vs ` A\<^sub>1\<rfloor>"
       by(simp add: image_Un)
     thus ?thesis using IH\<^sub>1 indexA\<^sub>1 by auto
   qed
 next
   case (Call e\<^sub>1 M es)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e\<^sub>1")
     case None thus ?thesis using Call by simp
   next
     case (Some A\<^sub>1)
     have indexA\<^sub>1: "\<A> (compE\<^sub>1 Vs e\<^sub>1) = \<lfloor>last_index Vs ` A\<^sub>1\<rfloor>"
       using A_compE\<^sub>1[OF Some] Call.prems  by auto
     have "A \<union> A\<^sub>1 \<subseteq> set Vs" using Call.prems A_fv[OF Some] by auto
     hence "\<D>s (compEs\<^sub>1 Vs es) \<lfloor>last_index Vs ` (A \<union> A\<^sub>1)\<rfloor>" using Call Some by auto
     hence "\<D>s (compEs\<^sub>1 Vs es) \<lfloor>last_index Vs ` A \<union> last_index Vs ` A\<^sub>1\<rfloor>"
       by(simp add: image_Un)
     thus ?thesis using IH\<^sub>1 indexA\<^sub>1 by auto
   qed
 next
   case (TryCatch e\<^sub>1 C V e\<^sub>2)
   have "\<lbrakk> A\<union>{V} \<subseteq> set(Vs@[V]); fv e\<^sub>2 \<subseteq> set(Vs@[V]); \<D> e\<^sub>2 \<lfloor>A\<union>{V}\<rfloor>\<rbrakk> \<Longrightarrow>
         \<D> (compE\<^sub>1 (Vs@[V]) e\<^sub>2) \<lfloor>last_index (Vs@[V]) ` (A\<union>{V})\<rfloor>" by fact
   hence "\<D> (compE\<^sub>1 (Vs@[V]) e\<^sub>2) \<lfloor>last_index (Vs@[V]) ` (A\<union>{V})\<rfloor>"
     using TryCatch.prems by(simp add:Diff_subset_conv)
   moreover have "last_index (Vs@[V]) ` A \<subseteq> last_index Vs ` A \<union> {size Vs}"
     using TryCatch.prems by(auto simp add: image_last_index split:if_split_asm)
   ultimately show ?case using TryCatch
     by(auto simp:hyperset_defs elim!:D_mono')
 next
   case (Seq e\<^sub>1 e\<^sub>2)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e\<^sub>1")
     case None thus ?thesis using Seq by simp
   next
     case (Some A\<^sub>1)
     have indexA\<^sub>1: "\<A> (compE\<^sub>1 Vs e\<^sub>1) = \<lfloor>last_index Vs ` A\<^sub>1\<rfloor>"
       using A_compE\<^sub>1[OF Some] Seq.prems  by auto
     have "A \<union> A\<^sub>1 \<subseteq> set Vs" using Seq.prems A_fv[OF Some] by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` (A \<union> A\<^sub>1)\<rfloor>" using Seq Some by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` A \<union> last_index Vs ` A\<^sub>1\<rfloor>"
       by(simp add: image_Un)
     thus ?thesis using IH\<^sub>1 indexA\<^sub>1 by auto
   qed
 next
   case (Cond e e\<^sub>1 e\<^sub>2)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e")
     case None thus ?thesis using Cond by simp
   next
     case (Some B)
     have indexB: "\<A> (compE\<^sub>1 Vs e) = \<lfloor>last_index Vs ` B\<rfloor>"
       using A_compE\<^sub>1[OF Some] Cond.prems  by auto
     have "A \<union> B \<subseteq> set Vs" using Cond.prems A_fv[OF Some] by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` (A \<union> B)\<rfloor>"
       and "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` (A \<union> B)\<rfloor>"
       using Cond Some by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A \<union> last_index Vs ` B\<rfloor>"
       and "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` A \<union> last_index Vs ` B\<rfloor>"
       by(simp add: image_Un)+
     thus ?thesis using IH\<^sub>1 indexB by auto
   qed
 next
   case (While e\<^sub>1 e\<^sub>2)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e\<^sub>1")
     case None thus ?thesis using While by simp
   next
     case (Some A\<^sub>1)
     have indexA\<^sub>1: "\<A> (compE\<^sub>1 Vs e\<^sub>1) = \<lfloor>last_index Vs ` A\<^sub>1\<rfloor>"
       using A_compE\<^sub>1[OF Some] While.prems  by auto
     have "A \<union> A\<^sub>1 \<subseteq> set Vs" using While.prems A_fv[OF Some] by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` (A \<union> A\<^sub>1)\<rfloor>" using While Some by auto
     hence "\<D> (compE\<^sub>1 Vs e\<^sub>2) \<lfloor>last_index Vs ` A \<union> last_index Vs ` A\<^sub>1\<rfloor>"
       by(simp add: image_Un)
     thus ?thesis using IH\<^sub>1 indexA\<^sub>1 by auto
   qed
 next
   case (Block V T e)
   have "\<lbrakk> A-{V} \<subseteq> set(Vs@[V]); fv e \<subseteq> set(Vs@[V]); \<D> e \<lfloor>A-{V}\<rfloor> \<rbrakk> \<Longrightarrow>
         \<D> (compE\<^sub>1 (Vs@[V]) e) \<lfloor>last_index (Vs@[V]) ` (A-{V})\<rfloor>" by fact
   hence "\<D> (compE\<^sub>1 (Vs@[V]) e) \<lfloor>last_index (Vs@[V]) ` (A-{V})\<rfloor>"
     using Block.prems by(simp add:Diff_subset_conv)
   moreover have "size Vs \<notin> last_index Vs ` A"
     using Block.prems by(auto simp add:image_def size_last_index_conv)
   ultimately show ?case using Block
     by(auto simp add: image_last_index Diff_subset_conv hyperset_defs elim!: D_mono')
 next
   case (Cons_exp e\<^sub>1 es)
   hence IH\<^sub>1: "\<D> (compE\<^sub>1 Vs e\<^sub>1) \<lfloor>last_index Vs ` A\<rfloor>" by simp
   show ?case
   proof (cases "\<A> e\<^sub>1")
     case None thus ?thesis using Cons_exp by simp
   next
     case (Some A\<^sub>1)
     have indexA\<^sub>1: "\<A> (compE\<^sub>1 Vs e\<^sub>1) = \<lfloor>last_index Vs ` A\<^sub>1\<rfloor>"
       using A_compE\<^sub>1[OF Some] Cons_exp.prems  by auto
     have "A \<union> A\<^sub>1 \<subseteq> set Vs" using Cons_exp.prems A_fv[OF Some] by auto
     hence "\<D>s (compEs\<^sub>1 Vs es) \<lfloor>last_index Vs ` (A \<union> A\<^sub>1)\<rfloor>" using Cons_exp Some by auto
     hence "\<D>s (compEs\<^sub>1 Vs es) \<lfloor>last_index Vs ` A \<union> last_index Vs ` A\<^sub>1\<rfloor>"
       by(simp add: image_Un)
     thus ?thesis using IH\<^sub>1 indexA\<^sub>1 by auto
   qed
 qed (simp_all add:hyperset_defs)
 (*>*)
 
 
 lemma last_index_image_set: "distinct xs \<Longrightarrow> last_index xs ` set xs = {..<size xs}"
 (*<*)by(induct xs rule:rev_induct) (auto simp add: image_last_index)(*>*)
 
 
 lemma D_compE\<^sub>1:
   "\<lbrakk> \<D> e \<lfloor>set Vs\<rfloor>; fv e \<subseteq> set Vs; distinct Vs \<rbrakk> \<Longrightarrow> \<D> (compE\<^sub>1 Vs e) \<lfloor>{..<length Vs}\<rfloor>"
 (*<*)by(fastforce dest!: D_last_index_compE\<^sub>1[OF subset_refl] simp add:last_index_image_set)(*>*)
 
 
 lemma D_compE\<^sub>1':
 assumes "\<D> e \<lfloor>set(V#Vs)\<rfloor>" and "fv e \<subseteq> set(V#Vs)" and "distinct(V#Vs)"
 shows "\<D> (compE\<^sub>1 (V#Vs) e) \<lfloor>{..length Vs}\<rfloor>"
 (*<*)
 proof -
   have "{..size Vs} = {..<size(V#Vs)}" by auto
   thus ?thesis using assms by (simp only:)(rule D_compE\<^sub>1)
 qed
 (*>*)
 
 lemma compP\<^sub>1_pres_wf: "wf_J_prog P \<Longrightarrow> wf_J\<^sub>1_prog (compP\<^sub>1 P)"
 (*<*)
-apply simp
-apply(rule wf_prog_compPI)
- prefer 2 apply assumption
-apply(case_tac m)
-apply(simp add:wf_mdecl_def wf_J\<^sub>1_mdecl_def)
-apply(clarify) apply(rename_tac C M b Ts T x1 x2 pns body)
-apply(case_tac b)
- apply clarsimp
- apply(frule WT_fv)
- apply(auto intro!: compE\<^sub>1_pres_wt D_compE\<^sub>1 \<B>)[1]
-apply clarsimp
-apply(frule WT_fv)
-apply(fastforce intro!: compE\<^sub>1_pres_wt D_compE\<^sub>1' \<B>)
-done
+proof -
+  assume wf: "wf_J_prog P"
+  let ?f = "(\<lambda>b (pns, body).
+           compE\<^sub>1 (case b of Static \<Rightarrow> pns | NonStatic \<Rightarrow> this # pns) body)"
+  let ?wf\<^sub>2 = "wf_J\<^sub>1_mdecl"
+
+  { fix C M b Ts T m
+    assume cM: "P \<turnstile> C sees M, b :  Ts\<rightarrow>T = m in C"
+      and wfm: "wf_mdecl wf_J_mdecl P C (M, b, Ts, T, m)"
+    obtain pns body where [simp]: "m = (pns, body)" by(cases m) simp
+    let ?E = "\<lambda>b. case b of Static \<Rightarrow> [pns [\<mapsto>] Ts] | NonStatic \<Rightarrow> [pns [\<mapsto>] Ts, this \<mapsto> Class C]"
+    obtain T' where WT: "P,?E b \<turnstile> body :: T'" and subT: "P \<turnstile> T' \<le> T"
+      using wfm by(cases b) (auto simp: wf_mdecl_def)
+    have fv: "fv body \<subseteq> dom (?E b)" by(rule WT_fv[OF WT])
+    have "wf_mdecl ?wf\<^sub>2 (compP ?f P) C (M, b, Ts, T, ?f b m)"
+    proof(cases b)
+      case Static then show ?thesis using cM wfm fv
+        by(auto simp:wf_mdecl_def wf_J\<^sub>1_mdecl_def
+                intro!: compE\<^sub>1_pres_wt D_compE\<^sub>1 \<B>)
+    next
+      case NonStatic then show ?thesis using cM wfm fv
+        by(clarsimp simp add:wf_mdecl_def wf_J\<^sub>1_mdecl_def)
+          (fastforce intro!: compE\<^sub>1_pres_wt D_compE\<^sub>1' \<B>)
+    qed
+  }
+  then show ?thesis by simp (rule wf_prog_compPI[OF _ wf])
+qed
 (*>*)
 
 
 end
diff --git a/thys/JinjaDCI/Compiler/Correctness2.thy b/thys/JinjaDCI/Compiler/Correctness2.thy
--- a/thys/JinjaDCI/Compiler/Correctness2.thy
+++ b/thys/JinjaDCI/Compiler/Correctness2.thy
@@ -1,3202 +1,3314 @@
 (*  Title:      JinjaDCI/Compiler/Correctness2.thy
     Author:     Tobias Nipkow, Susannah Mansky
     Copyright   TUM 2003, UIUC 2019-20
 
     Based on the Jinja theory Compiler/Correctness2.thy by Tobias Nipkow
 *)
 
 section \<open> Correctness of Stage 2 \<close>
 
 theory Correctness2
 imports "HOL-Library.Sublist" Compiler2 J1WellForm "../J/EConform"
 begin
 
 (*<*)hide_const (open) Throw(*>*)
 
 subsection\<open> Instruction sequences \<close>
 
 text\<open> How to select individual instructions and subsequences of
 instructions from a program given the class, method and program
 counter. \<close>
 
 definition before :: "jvm_prog \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> nat \<Rightarrow> instr list \<Rightarrow> bool"
    ("(_,_,_,_/ \<rhd> _)" [51,0,0,0,51] 50) where
  "P,C,M,pc \<rhd> is \<longleftrightarrow> prefix is (drop pc (instrs_of P C M))"
 
 definition at :: "jvm_prog \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> nat \<Rightarrow> instr \<Rightarrow> bool"
    ("(_,_,_,_/ \<triangleright> _)" [51,0,0,0,51] 50) where
  "P,C,M,pc \<triangleright> i \<longleftrightarrow> (\<exists>is. drop pc (instrs_of P C M) = i#is)"
 
 lemma [simp]: "P,C,M,pc \<rhd> []"
 (*<*)by(simp add:before_def)(*>*)
 
 
 lemma [simp]: "P,C,M,pc \<rhd> (i#is) = (P,C,M,pc \<triangleright> i \<and> P,C,M,pc + 1 \<rhd> is)"
 (*<*)by(fastforce simp add:before_def at_def prefix_def drop_Suc drop_tl)(*>*)
 
 (*<*)
 declare drop_drop[simp del]
 (*>*)
 
 
 lemma [simp]: "P,C,M,pc \<rhd> (is\<^sub>1 @ is\<^sub>2) = (P,C,M,pc \<rhd> is\<^sub>1 \<and> P,C,M,pc + size is\<^sub>1 \<rhd> is\<^sub>2)"
 (*<*)
-apply(simp add:before_def prefix_def)
-apply(subst add.commute)
-apply(simp add: drop_drop[symmetric])
-apply fastforce
-done
+by(subst add.commute)
+  (fastforce simp add:before_def prefix_def drop_drop[symmetric])
 (*>*)
 
 (*<*)
 declare drop_drop[simp]
 (*>*)
 
 
 lemma [simp]: "P,C,M,pc \<triangleright> i \<Longrightarrow> instrs_of P C M ! pc = i"
 (*<*)by(clarsimp simp add:at_def strict_prefix_def nth_via_drop)(*>*)
 
 lemma beforeM:
   "P \<turnstile> C sees M,b: Ts\<rightarrow>T = body in D \<Longrightarrow>
   compP\<^sub>2 P,D,M,0 \<rhd> compE\<^sub>2 body @ [Return]"
-(*<*)
-apply(drule sees_method_idemp)
-apply(simp add:before_def compP\<^sub>2_def compMb\<^sub>2_def)
-done
-(*>*)
+(*<*)by(drule sees_method_idemp) (simp add:before_def compMb\<^sub>2_def)(*>*)
 
 text\<open> This lemma executes a single instruction by rewriting: \<close>
 
 lemma [simp]:
   "P,C,M,pc \<triangleright> instr \<Longrightarrow>
   (P \<turnstile> (None, h, (vs,ls,C,M,pc,ics) # frs, sh) -jvm\<rightarrow> \<sigma>') =
   ((None, h, (vs,ls,C,M,pc,ics) # frs, sh) = \<sigma>' \<or>
    (\<exists>\<sigma>. exec(P,(None, h, (vs,ls,C,M,pc,ics) # frs, sh)) = Some \<sigma> \<and> P \<turnstile> \<sigma> -jvm\<rightarrow> \<sigma>'))"
 (*<*)
-apply(simp only: exec_all_def)
-apply(blast intro: converse_rtranclE converse_rtrancl_into_rtrancl)
-done
+by(simp only: exec_all_def)
+  (blast intro: converse_rtranclE converse_rtrancl_into_rtrancl)
 (*>*)
 
 
 subsection\<open> Exception tables \<close>
 
 definition pcs :: "ex_table \<Rightarrow> nat set"
 where
   "pcs xt  \<equiv>  \<Union>(f,t,C,h,d) \<in> set xt. {f ..< t}"
 
 lemma pcs_subset:
 shows "(\<And>pc d. pcs(compxE\<^sub>2 e pc d) \<subseteq> {pc..<pc+size(compE\<^sub>2 e)})"
 and "(\<And>pc d. pcs(compxEs\<^sub>2 es pc d) \<subseteq> {pc..<pc+size(compEs\<^sub>2 es)})"
 (*<*)
-apply(induct e and es rule: compxE\<^sub>2.induct compxEs\<^sub>2.induct)
-apply (simp_all add:pcs_def)
-apply (fastforce split:bop.splits)+
-done
+proof(induct e and es rule: compxE\<^sub>2.induct compxEs\<^sub>2.induct)
+  case Cast then show ?case by (fastforce simp:pcs_def)
+next
+  case BinOp then show ?case by (fastforce simp:pcs_def split:bop.splits)
+next
+  case LAss then show ?case by (fastforce simp: pcs_def)
+next
+  case FAcc then show ?case by (fastforce simp: pcs_def)
+next
+  case FAss then show ?case by (fastforce simp: pcs_def)
+next
+  case SFAss then show ?case by (fastforce simp: pcs_def)
+next
+  case Call then show ?case by (fastforce simp: pcs_def)
+next
+  case SCall then show ?case by (fastforce simp: pcs_def)
+next
+  case Seq then show ?case by (fastforce simp: pcs_def)
+next
+  case Cond then show ?case by (fastforce simp: pcs_def)
+next
+  case While then show ?case by (fastforce simp: pcs_def)
+next
+  case throw then show ?case by (fastforce simp: pcs_def)
+next
+  case TryCatch then show ?case by (fastforce simp: pcs_def)
+next
+  case Cons_exp then show ?case by (fastforce simp: pcs_def)
+qed (simp_all add:pcs_def)
 (*>*)
 
 
 lemma [simp]: "pcs [] = {}"
 (*<*)by(simp add:pcs_def)(*>*)
 
 
 lemma [simp]: "pcs (x#xt) = {fst x ..< fst(snd x)} \<union> pcs xt"
 (*<*)by(auto simp add: pcs_def)(*>*)
 
 
 lemma [simp]: "pcs(xt\<^sub>1 @ xt\<^sub>2) = pcs xt\<^sub>1 \<union> pcs xt\<^sub>2"
 (*<*)by(simp add:pcs_def)(*>*)
 
 
 lemma [simp]: "pc < pc\<^sub>0 \<or> pc\<^sub>0+size(compE\<^sub>2 e) \<le> pc \<Longrightarrow> pc \<notin> pcs(compxE\<^sub>2 e pc\<^sub>0 d)"
 (*<*)using pcs_subset by fastforce(*>*)
 
 
 lemma [simp]: "pc < pc\<^sub>0 \<or> pc\<^sub>0+size(compEs\<^sub>2 es) \<le> pc \<Longrightarrow> pc \<notin> pcs(compxEs\<^sub>2 es pc\<^sub>0 d)"
 (*<*)using pcs_subset by fastforce(*>*)
 
 
 lemma [simp]: "pc\<^sub>1 + size(compE\<^sub>2 e\<^sub>1) \<le> pc\<^sub>2 \<Longrightarrow> pcs(compxE\<^sub>2 e\<^sub>1 pc\<^sub>1 d\<^sub>1) \<inter> pcs(compxE\<^sub>2 e\<^sub>2 pc\<^sub>2 d\<^sub>2) = {}"
 (*<*)using pcs_subset by fastforce(*>*)
 
 
 lemma [simp]: "pc\<^sub>1 + size(compE\<^sub>2 e) \<le> pc\<^sub>2 \<Longrightarrow> pcs(compxE\<^sub>2 e pc\<^sub>1 d\<^sub>1) \<inter> pcs(compxEs\<^sub>2 es pc\<^sub>2 d\<^sub>2) = {}"
 (*<*)using pcs_subset by fastforce(*>*)
 
 
 lemma [simp]:
  "pc \<notin> pcs xt\<^sub>0 \<Longrightarrow> match_ex_table P C pc (xt\<^sub>0 @ xt\<^sub>1) = match_ex_table P C pc xt\<^sub>1"
 (*<*)by (induct xt\<^sub>0) (auto simp: matches_ex_entry_def)(*>*)
 
 
 lemma [simp]: "\<lbrakk> x \<in> set xt; pc \<notin> pcs xt \<rbrakk> \<Longrightarrow> \<not> matches_ex_entry P D pc x"
 (*<*)by(auto simp:matches_ex_entry_def pcs_def)(*>*)
 
 
 lemma [simp]:
 assumes xe: "xe \<in> set(compxE\<^sub>2 e pc d)" and outside: "pc' < pc \<or> pc+size(compE\<^sub>2 e) \<le> pc'"
 shows "\<not> matches_ex_entry P C pc' xe"
 (*<*)
 proof
   assume "matches_ex_entry P C pc' xe"
   with xe have "pc' \<in> pcs(compxE\<^sub>2 e pc d)"
     by(force simp add:matches_ex_entry_def pcs_def)
   with outside show False by simp
 qed
 (*>*)
 
 
 lemma [simp]:
 assumes xe: "xe \<in> set(compxEs\<^sub>2 es pc d)" and outside: "pc' < pc \<or> pc+size(compEs\<^sub>2 es) \<le> pc'"
 shows "\<not> matches_ex_entry P C pc' xe"
 (*<*)
 proof
   assume "matches_ex_entry P C pc' xe"
   with xe have "pc' \<in> pcs(compxEs\<^sub>2 es pc d)"
     by(force simp add:matches_ex_entry_def pcs_def)
   with outside show False by simp
 qed
 (*>*)
 
 
 lemma match_ex_table_app[simp]:
   "\<forall>xte \<in> set xt\<^sub>1. \<not> matches_ex_entry P D pc xte \<Longrightarrow>
   match_ex_table P D pc (xt\<^sub>1 @ xt) = match_ex_table P D pc xt"
 (*<*)by(induct xt\<^sub>1) simp_all(*>*)
 
 
 lemma [simp]:
   "\<forall>x \<in> set xtab. \<not> matches_ex_entry P C pc x \<Longrightarrow>
   match_ex_table P C pc xtab = None"
 (*<*)using match_ex_table_app[where ?xt = "[]"] by fastforce(*>*)
 
 
 lemma match_ex_entry:
   "matches_ex_entry P C pc (start, end, catch_type, handler) =
   (start \<le> pc \<and> pc < end \<and>  P \<turnstile> C \<preceq>\<^sup>* catch_type)"
 (*<*)by(simp add:matches_ex_entry_def)(*>*)
 
 
 definition caught :: "jvm_prog \<Rightarrow> pc \<Rightarrow> heap \<Rightarrow> addr \<Rightarrow> ex_table \<Rightarrow> bool" where
   "caught P pc h a xt \<longleftrightarrow>
   (\<exists>entry \<in> set xt. matches_ex_entry P (cname_of h a) pc entry)"
 
 definition beforex :: "jvm_prog \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> ex_table \<Rightarrow> nat set \<Rightarrow> nat \<Rightarrow> bool"
               ("(2_,/_,/_ \<rhd>/ _ /'/ _,/_)" [51,0,0,0,0,51] 50) where
   "P,C,M \<rhd> xt / I,d \<longleftrightarrow>
   (\<exists>xt\<^sub>0 xt\<^sub>1. ex_table_of P C M = xt\<^sub>0 @ xt @ xt\<^sub>1 \<and> pcs xt\<^sub>0 \<inter> I = {} \<and> pcs xt \<subseteq> I \<and>
     (\<forall>pc \<in> I. \<forall>C pc' d'. match_ex_table P C pc xt\<^sub>1 = \<lfloor>(pc',d')\<rfloor> \<longrightarrow> d' \<le> d))"
 
 definition dummyx :: "jvm_prog \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> ex_table \<Rightarrow> nat set \<Rightarrow> nat \<Rightarrow> bool"  ("(2_,_,_ \<triangleright>/ _ '/_,_)" [51,0,0,0,0,51] 50) where
   "P,C,M \<triangleright> xt/I,d \<longleftrightarrow> P,C,M \<rhd> xt/I,d"
 
+abbreviation
+"beforex\<^sub>0 P C M d I xt xt\<^sub>0 xt\<^sub>1
+  \<equiv> ex_table_of P C M = xt\<^sub>0 @ xt @ xt\<^sub>1 \<and> pcs xt\<^sub>0 \<inter> I = {}
+      \<and> pcs xt \<subseteq> I \<and> (\<forall>pc \<in> I. \<forall>C pc' d'. match_ex_table P C pc xt\<^sub>1 = \<lfloor>(pc',d')\<rfloor> \<longrightarrow> d' \<le> d)"
+
+lemma beforex_beforex\<^sub>0_eq:
+ "P,C,M \<rhd> xt / I,d \<equiv> \<exists>xt\<^sub>0 xt\<^sub>1. beforex\<^sub>0 P C M d I xt xt\<^sub>0 xt\<^sub>1"
+using beforex_def by auto
+
 lemma beforexD1: "P,C,M \<rhd> xt / I,d \<Longrightarrow> pcs xt \<subseteq> I"
 (*<*)by(auto simp add:beforex_def)(*>*)
 
 
 lemma beforex_mono: "\<lbrakk> P,C,M \<rhd> xt/I,d'; d' \<le> d \<rbrakk> \<Longrightarrow> P,C,M \<rhd> xt/I,d"
 (*<*)by(fastforce simp:beforex_def)(*>*)
 
 
 lemma [simp]: "P,C,M \<rhd> xt/I,d \<Longrightarrow> P,C,M \<rhd> xt/I,Suc d"
 (*<*)by(fastforce intro:beforex_mono)(*>*)
 
 
 lemma beforex_append[simp]:
   "pcs xt\<^sub>1 \<inter> pcs xt\<^sub>2 = {} \<Longrightarrow>
   P,C,M \<rhd> xt\<^sub>1 @ xt\<^sub>2/I,d =
   (P,C,M \<rhd> xt\<^sub>1/I-pcs xt\<^sub>2,d  \<and>  P,C,M \<rhd> xt\<^sub>2/I-pcs xt\<^sub>1,d \<and> P,C,M \<triangleright> xt\<^sub>1@xt\<^sub>2/I,d)"
-(*<*)
-apply(rule iffI)
- prefer 2
- apply(simp add:dummyx_def)
-apply(auto simp add: beforex_def dummyx_def)
- apply(rule_tac x = xt\<^sub>0 in exI)
- apply auto
-apply(rule_tac x = "xt\<^sub>0@xt\<^sub>1" in exI)
-apply auto
-done
+(*<*)(is "?Q \<Longrightarrow> ?P = (?P1 \<and> ?P2 \<and> ?P3)" is "?Q \<Longrightarrow> ?P = ?P123")
+proof -
+  assume pcs: ?Q
+  show ?thesis proof(rule iffI)
+    assume "?P123" then show ?P by(simp add:dummyx_def)
+  next
+    assume hyp: ?P
+    let ?xt = "xt\<^sub>1 @ xt\<^sub>2"
+    let ?beforex = "beforex\<^sub>0 P C M d"
+    obtain xt\<^sub>0 xt\<^sub>1' where beforex: "?beforex I ?xt xt\<^sub>0 xt\<^sub>1'"
+      using hyp by(clarsimp simp: beforex_def)
+    have "\<exists>xt\<^sub>0 xt\<^sub>1'. ?beforex (I - pcs xt\<^sub>2) xt\<^sub>1 xt\<^sub>0 xt\<^sub>1'" \<comment> \<open>?P1\<close>
+      using pcs beforex by(rule_tac x=xt\<^sub>0 in exI) auto
+    moreover have "\<exists>xt\<^sub>0 xt\<^sub>1'. ?beforex (I - pcs xt\<^sub>1) xt\<^sub>2 xt\<^sub>0 xt\<^sub>1'"  \<comment> \<open>?P2\<close>
+      using pcs beforex by(rule_tac x="xt\<^sub>0@xt\<^sub>1" in exI) auto
+    moreover have ?P3 using hyp by(simp add: dummyx_def)
+    ultimately show ?P123 by (simp add: beforex_def)
+  qed
+qed
 (*>*)
 
 
 lemma beforex_appendD1:
-  "\<lbrakk> P,C,M \<rhd> xt\<^sub>1 @ xt\<^sub>2 @ [(f,t,D,h,d)] / I,d;
-    pcs xt\<^sub>1 \<subseteq> J; J \<subseteq> I; J \<inter> pcs xt\<^sub>2 = {} \<rbrakk>
-  \<Longrightarrow> P,C,M \<rhd> xt\<^sub>1 / J,d"
+assumes bx: "P,C,M \<rhd> xt\<^sub>1 @ xt\<^sub>2 @ [(f,t,D,h,d)] / I,d"
+  and pcs: "pcs xt\<^sub>1 \<subseteq> J" and JI: "J \<subseteq> I" and Jpcs: "J \<inter> pcs xt\<^sub>2 = {}"
+shows "P,C,M \<rhd> xt\<^sub>1 / J,d"
 (*<*)
-apply(auto simp:beforex_def)
-apply(rule exI,rule exI,rule conjI, rule refl)
-apply(rule conjI, blast)
-apply(auto)
-apply(subgoal_tac "pc \<notin> pcs xt\<^sub>2")
- prefer 2 apply blast
-apply (auto split:if_split_asm)
-done
+proof -
+  let ?beforex = "beforex\<^sub>0 P C M d"
+  obtain xt\<^sub>0 xt\<^sub>1' where bx': "?beforex I (xt\<^sub>1 @ xt\<^sub>2 @ [(f,t,D,h,d)]) xt\<^sub>0 xt\<^sub>1'"
+    using bx by(clarsimp simp:beforex_def)
+  let ?xt0 = xt\<^sub>0 and ?xt1 = "xt\<^sub>2 @ (f, t, D, h, d) # xt\<^sub>1'"
+  have "pcs xt\<^sub>0 \<inter> J = {}" using bx' JI by blast
+  moreover {
+    fix pc C pc' d' assume pcJ: "pc\<in>J"
+    then have "pc \<notin> pcs xt\<^sub>2" using bx' Jpcs by blast
+    then have "match_ex_table P C pc (xt\<^sub>2 @ (f, t, D, h, d) # xt\<^sub>1')
+                   = \<lfloor>(pc', d')\<rfloor> \<longrightarrow> d' \<le> d"
+      using bx' JI pcJ by (auto split:if_split_asm)
+  }
+  ultimately have "?beforex J xt\<^sub>1 ?xt0 ?xt1" using bx' pcs by simp
+  then show ?thesis using beforex_def by blast
+qed
 (*>*)
 
 
 lemma beforex_appendD2:
-  "\<lbrakk> P,C,M \<rhd> xt\<^sub>1 @ xt\<^sub>2 @ [(f,t,D,h,d)] / I,d;
-    pcs xt\<^sub>2 \<subseteq> J; J \<subseteq> I; J \<inter> pcs xt\<^sub>1 = {} \<rbrakk>
-  \<Longrightarrow> P,C,M \<rhd> xt\<^sub>2 / J,d"
+assumes bx: "P,C,M \<rhd> xt\<^sub>1 @ xt\<^sub>2 @ [(f,t,D,h,d)] / I,d"
+  and pcs: "pcs xt\<^sub>2 \<subseteq> J" and JI: "J \<subseteq> I" and Jpcs: "J \<inter> pcs xt\<^sub>1 = {}"
+shows "P,C,M \<rhd> xt\<^sub>2 / J,d"
 (*<*)
-apply(auto simp:beforex_def)
-apply(rule_tac x = "xt\<^sub>0 @ xt\<^sub>1" in exI)
-apply fastforce
-done
+proof -
+  let ?beforex = "beforex\<^sub>0 P C M d"
+  obtain xt\<^sub>0 xt\<^sub>1' where bx': "?beforex I (xt\<^sub>1 @ xt\<^sub>2 @ [(f,t,D,h,d)]) xt\<^sub>0 xt\<^sub>1'"
+    using bx by(clarsimp simp:beforex_def)
+  then have "\<exists>xt\<^sub>1''. beforex\<^sub>0 P C M d J xt\<^sub>2 (xt\<^sub>0 @ xt\<^sub>1) xt\<^sub>1''"
+    using assms by fastforce
+  then show ?thesis using beforex_def by blast
+qed
 (*>*)
 
 
 lemma beforexM:
   "P \<turnstile> C sees M,b: Ts\<rightarrow>T = body in D \<Longrightarrow> compP\<^sub>2 P,D,M \<rhd> compxE\<^sub>2 body 0 0/{..<size(compE\<^sub>2 body)},0"
 (*<*)
-apply(drule sees_method_idemp)
-apply(drule sees_method_compP[where f = compMb\<^sub>2])
-apply(simp add:beforex_def compP\<^sub>2_def compMb\<^sub>2_def)
-apply(rule_tac x = "[]" in exI)
-using pcs_subset apply fastforce
-done
+proof -
+  assume cM: "P \<turnstile> C sees M,b: Ts\<rightarrow>T = body in D"
+  let ?xt0 = "[]"
+  have "\<exists>xt1. beforex\<^sub>0 (compP\<^sub>2 P) D M 0 ({..<size(compE\<^sub>2 body)}) (compxE\<^sub>2 body 0 0) ?xt0 xt1"
+    using sees_method_compP[where f = compMb\<^sub>2, OF sees_method_idemp[OF cM]]
+          pcs_subset by(fastforce simp add: compP\<^sub>2_def compMb\<^sub>2_def)
+  then show ?thesis using beforex_def by blast
+qed
 (*>*)
 
 
 lemma match_ex_table_SomeD2:
- "\<lbrakk> match_ex_table P D pc (ex_table_of P C M) = \<lfloor>(pc',d')\<rfloor>;
-    P,C,M \<rhd> xt/I,d; \<forall>x \<in> set xt. \<not> matches_ex_entry P D pc x; pc \<in> I \<rbrakk>
- \<Longrightarrow> d' \<le> d"
+assumes met: "match_ex_table P D pc (ex_table_of P C M) = \<lfloor>(pc',d')\<rfloor>"
+  and bx: "P,C,M \<rhd> xt/I,d"
+  and nmet: "\<forall>x \<in> set xt. \<not> matches_ex_entry P D pc x" and pcI: "pc \<in> I"
+shows "d' \<le> d"
 (*<*)
-apply(auto simp:beforex_def)
-apply(subgoal_tac "pc \<notin> pcs xt\<^sub>0")
-apply auto
-done
+proof -
+  obtain xt\<^sub>0 xt\<^sub>1 where bx': "beforex\<^sub>0 P C M d I xt xt\<^sub>0 xt\<^sub>1"
+    using bx by(clarsimp simp:beforex_def)
+  then have "pc \<notin> pcs xt\<^sub>0" using pcI by blast
+  then show ?thesis using bx' met nmet pcI by simp
+qed
 (*>*)
 
 
 lemma match_ex_table_SomeD1:
   "\<lbrakk> match_ex_table P D pc (ex_table_of P C M) = \<lfloor>(pc',d')\<rfloor>;
      P,C,M \<rhd> xt / I,d; pc \<in> I; pc \<notin> pcs xt \<rbrakk> \<Longrightarrow> d' \<le> d"
 (*<*)by(auto elim: match_ex_table_SomeD2)(*>*)
 
 
 subsection\<open> The correctness proof \<close>
 
 (*<*)
 declare nat_add_distrib[simp] caught_def[simp]
 declare fun_upd_apply[simp del]
 (*>*)
 
 definition
   handle :: "jvm_prog \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> addr \<Rightarrow> heap \<Rightarrow> val list \<Rightarrow> val list \<Rightarrow> nat \<Rightarrow> init_call_status \<Rightarrow> frame list \<Rightarrow> sheap
                 \<Rightarrow> jvm_state" where
   "handle P C M a h vs ls pc ics frs sh = find_handler P a h ((vs,ls,C,M,pc,ics) # frs) sh"
 
 lemma aux_isin[simp]: "\<lbrakk> B \<subseteq> A; a \<in> B \<rbrakk> \<Longrightarrow> a \<in> A"
 (*<*)by blast(*>*)
 
 lemma handle_frs_tl_neq:
  "ics_of f \<noteq> No_ics
   \<Longrightarrow> (xp, h, f#frs, sh) \<noteq> handle P C M xa h' vs l pc ics frs sh'"
  by(simp add: handle_def find_handler_frs_tl_neq del: find_handler.simps)
 
 subsubsection "Correctness proof inductive hypothesis"
 
 \<comment> \<open> frame definitions for use by correctness proof inductive hypothesis \<close>
 fun calling_to_called :: "frame \<Rightarrow> frame" where
 "calling_to_called (stk,loc,D,M,pc,ics) = (stk,loc,D,M,pc,case ics of Calling C Cs \<Rightarrow> Called (C#Cs))"
 
 fun calling_to_scalled :: "frame \<Rightarrow> frame" where
 "calling_to_scalled (stk,loc,D,M,pc,ics) = (stk,loc,D,M,pc,case ics of Calling C Cs \<Rightarrow> Called Cs)"
 
 fun calling_to_calling :: "frame \<Rightarrow> cname \<Rightarrow> frame" where
 "calling_to_calling (stk,loc,D,M,pc,ics) C' = (stk,loc,D,M,pc,case ics of Calling C Cs \<Rightarrow> Calling C' (C#Cs))"
 
 fun calling_to_throwing :: "frame \<Rightarrow> addr \<Rightarrow> frame" where
 "calling_to_throwing (stk,loc,D,M,pc,ics) a = (stk,loc,D,M,pc,case ics of Calling C Cs \<Rightarrow> Throwing (C#Cs) a)"
 
 fun calling_to_sthrowing :: "frame \<Rightarrow> addr \<Rightarrow> frame" where
 "calling_to_sthrowing (stk,loc,D,M,pc,ics) a = (stk,loc,D,M,pc,case ics of Calling C Cs \<Rightarrow> Throwing Cs a)"
 
 
 \<comment> \<open> pieces of the correctness proof's inductive hypothesis, which depend on the
  expression being compiled) \<close>
 
 fun Jcc_cond :: "J\<^sub>1_prog \<Rightarrow> ty list \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> val list \<Rightarrow> pc \<Rightarrow> init_call_status
    \<Rightarrow> nat set \<Rightarrow> heap \<Rightarrow> sheap \<Rightarrow> expr\<^sub>1 \<Rightarrow> bool" where
 "Jcc_cond P E C M vs pc ics I h sh (INIT C\<^sub>0 (Cs,b) \<leftarrow> e')
   = ((\<exists>T. P,E,h,sh \<turnstile>\<^sub>1 INIT C\<^sub>0 (Cs,b) \<leftarrow> e' : T) \<and> unit = e' \<and> ics = No_ics)" |
 "Jcc_cond P E C M vs pc ics I h sh (RI(C',e\<^sub>0);Cs \<leftarrow> e')
   = (((e\<^sub>0 = C'\<bullet>\<^sub>sclinit([]) \<and> (\<exists>T. P,E,h,sh \<turnstile>\<^sub>1 RI(C',e\<^sub>0);Cs \<leftarrow> e':T))
          \<or> ((\<exists>a. e\<^sub>0 = Throw a) \<and> (\<forall>C \<in> set(C'#Cs). is_class P C)))
       \<and> unit = e' \<and> ics = No_ics)" |
 "Jcc_cond P E C M vs pc ics I h sh (C'\<bullet>\<^sub>sM'(es))
   = (let e = (C'\<bullet>\<^sub>sM'(es))
      in if M' = clinit \<and> es = [] then (\<exists>T. P,E,h,sh \<turnstile>\<^sub>1 e:T) \<and> (\<exists>Cs. ics = Called Cs)
         else (compP\<^sub>2 P,C,M,pc \<rhd> compE\<^sub>2 e \<and> compP\<^sub>2 P,C,M \<rhd> compxE\<^sub>2 e pc (size vs)/I,size vs
                   \<and> {pc..<pc+size(compE\<^sub>2 e)} \<subseteq> I \<and> \<not>sub_RI e \<and> ics = No_ics)
     )" |
 "Jcc_cond P E C M vs pc ics I h sh e
   = (compP\<^sub>2 P,C,M,pc \<rhd> compE\<^sub>2 e \<and> compP\<^sub>2 P,C,M \<rhd> compxE\<^sub>2 e pc (size vs)/I,size vs
                   \<and> {pc..<pc+size(compE\<^sub>2 e)} \<subseteq> I \<and> \<not>sub_RI e \<and> ics = No_ics)"
 
 
 fun Jcc_frames :: "jvm_prog \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> val list \<Rightarrow> val list \<Rightarrow> pc \<Rightarrow> init_call_status
   \<Rightarrow> frame list \<Rightarrow> expr\<^sub>1 \<Rightarrow> frame list" where
 "Jcc_frames P C M vs ls pc ics frs (INIT C\<^sub>0 (C'#Cs,b) \<leftarrow> e')
   = (case b of False \<Rightarrow> (vs,ls,C,M,pc,Calling C' Cs) # frs
              | True \<Rightarrow> (vs,ls,C,M,pc,Called (C'#Cs)) # frs
     )" |
 "Jcc_frames P C M vs ls pc ics frs (INIT C\<^sub>0 (Nil,b) \<leftarrow> e')
   = (vs,ls,C,M,pc,Called [])#frs" |
 "Jcc_frames P C M vs ls pc ics frs (RI(C',e\<^sub>0);Cs \<leftarrow> e')
   = (case e\<^sub>0 of Throw a \<Rightarrow> (vs,ls,C,M,pc,Throwing (C'#Cs) a) # frs
               | _ \<Rightarrow> (vs,ls,C,M,pc,Called (C'#Cs)) # frs )" |
 "Jcc_frames P C M vs ls pc ics frs (C'\<bullet>\<^sub>sM'(es))
   = (if M' = clinit \<and> es = []
      then create_init_frame P C'#(vs,ls,C,M,pc,ics)#frs
      else (vs,ls,C,M,pc,ics)#frs
     )" |
 "Jcc_frames P C M vs ls pc ics frs e
   = (vs,ls,C,M,pc,ics)#frs"
 
 fun Jcc_rhs :: "J\<^sub>1_prog \<Rightarrow> ty list \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> val list \<Rightarrow> val list \<Rightarrow> pc \<Rightarrow> init_call_status
   \<Rightarrow> frame list \<Rightarrow> heap \<Rightarrow> val list \<Rightarrow> sheap \<Rightarrow> val \<Rightarrow> expr\<^sub>1 \<Rightarrow> jvm_state" where
 "Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v (INIT C\<^sub>0 (Cs,b) \<leftarrow> e')
   = (None,h',(vs,ls,C,M,pc,Called [])#frs,sh')" |
 "Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v (RI(C',e\<^sub>0);Cs \<leftarrow> e')
   = (None,h',(vs,ls,C,M,pc,Called [])#frs,sh')" |
 "Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v (C'\<bullet>\<^sub>sM'(es))
   = (let e = (C'\<bullet>\<^sub>sM'(es))
      in if M' = clinit \<and> es = []
         then (None,h',(vs,ls,C,M,pc,ics)#frs,sh'(C'\<mapsto>(fst(the(sh' C')),Done)))
         else (None,h',(v#vs,ls',C,M,pc+size(compE\<^sub>2 e),ics)#frs,sh')
     )" |
 "Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v e
   = (None,h',(v#vs,ls',C,M,pc+size(compE\<^sub>2 e),ics)#frs,sh')"
 
 fun Jcc_err :: "jvm_prog \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> heap \<Rightarrow> val list \<Rightarrow> val list \<Rightarrow> pc \<Rightarrow> init_call_status
   \<Rightarrow> frame list \<Rightarrow> sheap \<Rightarrow> nat set \<Rightarrow> heap \<Rightarrow> val list \<Rightarrow> sheap \<Rightarrow> addr \<Rightarrow> expr\<^sub>1
   \<Rightarrow> bool" where
 "Jcc_err P C M h vs ls pc ics frs sh I h' ls' sh' xa (INIT C\<^sub>0 (Cs,b) \<leftarrow> e')
   = (\<exists>vs'. P \<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs (INIT C\<^sub>0 (Cs,b) \<leftarrow> e'),sh)
            -jvm\<rightarrow> handle P C M xa h' (vs'@vs) ls pc ics frs sh')" |
 "Jcc_err P C M h vs ls pc ics frs sh I h' ls' sh' xa (RI(C',e\<^sub>0);Cs \<leftarrow> e')
   = (\<exists>vs'. P \<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs (RI(C',e\<^sub>0);Cs \<leftarrow> e'),sh)
            -jvm\<rightarrow> handle P C M xa h' (vs'@vs) ls pc ics frs sh')" |
 "Jcc_err P C M h vs ls pc ics frs sh I h' ls' sh' xa (C'\<bullet>\<^sub>sM'(es))
   = (let e = (C'\<bullet>\<^sub>sM'(es))
      in if M' = clinit \<and> es = []
         then case ics of
                Called Cs \<Rightarrow> P \<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs e,sh)
                        -jvm\<rightarrow> (None,h',(vs,ls,C,M,pc,Throwing Cs xa)#frs,(sh'(C' \<mapsto> (fst(the(sh' C')),Error))))
         else (\<exists>pc\<^sub>1. pc \<le> pc\<^sub>1 \<and> pc\<^sub>1 < pc + size(compE\<^sub>2 e) \<and>
                \<not> caught P pc\<^sub>1 h' xa (compxE\<^sub>2 e pc (size vs)) \<and>
                (\<exists>vs'. P \<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs e,sh)
                       -jvm\<rightarrow> handle P C M xa h' (vs'@vs) ls' pc\<^sub>1 ics frs sh'))
     )" |
 "Jcc_err P C M h vs ls pc ics frs sh I h' ls' sh' xa e
   = (\<exists>pc\<^sub>1. pc \<le> pc\<^sub>1 \<and> pc\<^sub>1 < pc + size(compE\<^sub>2 e) \<and>
                \<not> caught P pc\<^sub>1 h' xa (compxE\<^sub>2 e pc (size vs)) \<and>
                (\<exists>vs'. P \<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs e,sh)
                       -jvm\<rightarrow> handle P C M xa h' (vs'@vs) ls' pc\<^sub>1 ics frs sh'))"
 
 fun Jcc_pieces :: "J\<^sub>1_prog \<Rightarrow> ty list \<Rightarrow> cname \<Rightarrow> mname \<Rightarrow> heap \<Rightarrow> val list \<Rightarrow> val list \<Rightarrow> pc \<Rightarrow> init_call_status
   \<Rightarrow> frame list \<Rightarrow> sheap \<Rightarrow> nat set \<Rightarrow> heap \<Rightarrow> val list \<Rightarrow> sheap \<Rightarrow> val \<Rightarrow> addr \<Rightarrow> expr\<^sub>1
   \<Rightarrow> bool \<times> frame list \<times> jvm_state \<times> bool" where
 "Jcc_pieces P E C M h vs ls pc ics frs sh I h' ls' sh' v xa e
   = (Jcc_cond P E C M vs pc ics I h sh e, Jcc_frames (compP\<^sub>2 P) C M vs ls pc ics frs e,
       Jcc_rhs P E C M vs ls pc ics frs h' ls' sh' v e,
       Jcc_err (compP\<^sub>2 P) C M h vs ls pc ics frs sh I h' ls' sh' xa e)"
 
 \<comment> \<open> @{text Jcc_pieces} lemmas \<close>
 
 lemma nsub_RI_Jcc_pieces:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
   and nsub: "\<not>sub_RI e"
 shows "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa e 
   = (let cond = P,C,M,pc \<rhd> compE\<^sub>2 e \<and> P,C,M \<rhd> compxE\<^sub>2 e pc (size vs)/I,size vs
                   \<and> {pc..<pc+size(compE\<^sub>2 e)} \<subseteq> I \<and> ics = No_ics;
          frs' = (vs,ls,C,M,pc,ics)#frs;
          rhs = (None,h',(v#vs,ls',C,M,pc+size(compE\<^sub>2 e),ics)#frs,sh');
          err = (\<exists>pc\<^sub>1. pc \<le> pc\<^sub>1 \<and> pc\<^sub>1 < pc + size(compE\<^sub>2 e) \<and>
                \<not> caught P pc\<^sub>1 h' xa (compxE\<^sub>2 e pc (size vs)) \<and>
                (\<exists>vs'. P \<turnstile> (None,h,frs',sh) -jvm\<rightarrow> handle P C M xa h' (vs'@vs) ls' pc\<^sub>1 ics frs sh'))
      in (cond, frs',rhs, err)
     )"
 proof -
   have NC: "\<forall>C'. e \<noteq> C'\<bullet>\<^sub>sclinit([])" using assms(2) proof(cases e) qed(simp_all)
   then show ?thesis using assms
   proof(cases e)
     case (SCall C M es)
     then have "M \<noteq> clinit" using nsub by simp
     then show ?thesis using SCall nsub proof(cases es) qed(simp_all)
   qed(simp_all)
 qed
 
 lemma Jcc_pieces_Cast:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
  and "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (Cast C' e)
    = (True, frs\<^sub>0, (xp',h',(v#vs',ls',C\<^sub>0,M',pc',ics')#frs',sh'), err)"
 shows "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v' xa e
    = (True, frs\<^sub>0, (xp',h',(v'#vs',ls',C\<^sub>0,M',pc' - 1,ics')#frs',sh'),
         (\<exists>pc\<^sub>1. pc \<le> pc\<^sub>1 \<and> pc\<^sub>1 < pc + size(compE\<^sub>2 e) \<and>
                \<not> caught P pc\<^sub>1 h\<^sub>1 xa (compxE\<^sub>2 e pc (size vs)) \<and>
                (\<exists>vs'. P \<turnstile> (None,h\<^sub>0,frs\<^sub>0,sh\<^sub>0) -jvm\<rightarrow> handle P C M xa h\<^sub>1 (vs'@vs) ls\<^sub>1 pc\<^sub>1 ics frs sh\<^sub>1)))"
 proof -
   have pc: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> I" using assms by clarsimp
   show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] pc by clarsimp
 qed
 
 lemma Jcc_pieces_BinOp1:
 assumes
  "Jcc_pieces P E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e \<guillemotleft>bop\<guillemotright> e')
    = (True, frs\<^sub>0, (xp',h',(v#vs',ls',C\<^sub>0,M',pc',ics')#frs',sh'), err)"
 shows "\<exists>err. Jcc_pieces P E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0
  (I - pcs (compxE\<^sub>2 e' (pc + length (compE\<^sub>2 e)) (Suc (length vs')))) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v' xa e
    = (True, frs\<^sub>0, (xp',h\<^sub>1,(v'#vs',ls\<^sub>1,C\<^sub>0,M',pc' - size (compE\<^sub>2 e') - 1,ics')#frs',sh\<^sub>1), err)"
 proof -
   have bef: "compP compMb\<^sub>2 P,C\<^sub>0,M' \<rhd> compxE\<^sub>2 e pc (length vs) 
          / I - pcs (compxE\<^sub>2 e' (pc + length (compE\<^sub>2 e)) (Suc (length vs'))),length vs"
     using assms by clarsimp
   have vs: "vs = vs'" using assms by simp
   show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] bef vs by clarsimp
 qed
 
 lemma Jcc_pieces_BinOp2:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
  and "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e \<guillemotleft>bop\<guillemotright> e')
    = (True, frs\<^sub>0, (xp',h',(v#vs',ls',C\<^sub>0,M',pc',ics')#frs',sh'), err)"
 shows "\<exists>err. Jcc_pieces P\<^sub>1 E C M h\<^sub>1 (v\<^sub>1#vs) ls\<^sub>1 (pc + size (compE\<^sub>2 e)) ics frs sh\<^sub>1
    (I - pcs (compxE\<^sub>2 e pc (length vs'))) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v' xa e'
    = (True, (v\<^sub>1#vs,ls\<^sub>1,C,M,pc + size (compE\<^sub>2 e),ics)#frs,
        (xp',h',(v'#v\<^sub>1#vs',ls',C\<^sub>0,M',pc' - 1,ics')#frs',sh'),
           (\<exists>pc\<^sub>1. pc + size (compE\<^sub>2 e) \<le> pc\<^sub>1 \<and> pc\<^sub>1 < pc + size (compE\<^sub>2 e) + length (compE\<^sub>2 e') \<and>
                \<not> caught P pc\<^sub>1 h\<^sub>2 xa (compxE\<^sub>2 e' (pc + size (compE\<^sub>2 e)) (Suc (length vs))) \<and>
                (\<exists>vs'. P \<turnstile> (None,h\<^sub>1,(v\<^sub>1#vs,ls\<^sub>1,C,M,pc + size (compE\<^sub>2 e),ics)#frs,sh\<^sub>1)
                        -jvm\<rightarrow> handle P C M xa h\<^sub>2 (vs'@v\<^sub>1#vs) ls\<^sub>2 pc\<^sub>1 ics frs sh\<^sub>2)))"
 proof -
   have bef: "compP compMb\<^sub>2 P\<^sub>1,C\<^sub>0,M' \<rhd> compxE\<^sub>2 e pc (length vs) 
          / I - pcs (compxE\<^sub>2 e' (pc + length (compE\<^sub>2 e)) (Suc (length vs'))),length vs"
     using assms by clarsimp
   have vs: "vs = vs'" using assms by simp
   show ?thesis using assms nsub_RI_Jcc_pieces[where e=e'] bef vs by clarsimp
 qed
 
 lemma Jcc_pieces_FAcc:
 assumes
  "Jcc_pieces P E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (e\<bullet>F{D})
    = (True, frs\<^sub>0, (xp',h',(v#vs',ls',C\<^sub>0,M',pc',ics')#frs',sh'), err)"
 shows "\<exists>err. Jcc_pieces P E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v' xa e
    = (True, frs\<^sub>0, (xp',h',(v'#vs',ls',C\<^sub>0,M',pc' - 1,ics')#frs',sh'), err)"
 proof -
   have pc: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> I" using assms by clarsimp
   then show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] by clarsimp
 qed
 
 lemma Jcc_pieces_LAss:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
  and "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (i:=e)
    = (True, frs\<^sub>0, (xp',h',(v#vs',ls',C\<^sub>0,M',pc',ics')#frs',sh'), err)"
 shows "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v' xa e
    = (True, frs\<^sub>0, (xp',h',(v'#vs',ls',C\<^sub>0,M',pc' - 2,ics')#frs',sh'),
         (\<exists>pc\<^sub>1. pc \<le> pc\<^sub>1 \<and> pc\<^sub>1 < pc + size(compE\<^sub>2 e) \<and>
                \<not> caught P pc\<^sub>1 h\<^sub>1 xa (compxE\<^sub>2 e pc (size vs)) \<and>
                (\<exists>vs'. P \<turnstile> (None,h\<^sub>0,frs\<^sub>0,sh\<^sub>0) -jvm\<rightarrow> handle P C M xa h\<^sub>1 (vs'@vs) ls\<^sub>1 pc\<^sub>1 ics frs sh\<^sub>1)))"
 proof -
   have pc: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> I" using assms by clarsimp
   show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] pc by clarsimp
 qed
 
 lemma Jcc_pieces_FAss1:
 assumes
  "Jcc_pieces P E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e\<bullet>F{D}:=e')
    = (True, frs\<^sub>0, (xp',h',(v#vs',ls',C\<^sub>0,M',pc',ics')#frs',sh'), err)"
 shows "\<exists>err. Jcc_pieces P E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0
  (I - pcs (compxE\<^sub>2 e' (pc + length (compE\<^sub>2 e)) (Suc (length vs')))) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v' xa e
    = (True, frs\<^sub>0, (xp',h\<^sub>1,(v'#vs',ls\<^sub>1,C\<^sub>0,M',pc' - size (compE\<^sub>2 e') - 2,ics')#frs',sh\<^sub>1), err)"
 proof -
   show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] by clarsimp
 qed
 
 lemma Jcc_pieces_FAss2:
 assumes
  "Jcc_pieces P E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e\<bullet>F{D}:=e')
    = (True, frs\<^sub>0, (xp',h',(v#vs',ls',C\<^sub>0,M',pc',ics')#frs',sh'), err)"
 shows "Jcc_pieces P E C M h\<^sub>1 (v\<^sub>1#vs) ls\<^sub>1 (pc + size (compE\<^sub>2 e)) ics frs sh\<^sub>1
    (I - pcs (compxE\<^sub>2 e pc (length vs'))) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v' xa e'
    = (True, (v\<^sub>1#vs,ls\<^sub>1,C,M,pc + size (compE\<^sub>2 e),ics)#frs,
        (xp',h',(v'#v\<^sub>1#vs',ls',C\<^sub>0,M',pc' - 2,ics')#frs',sh'),
         (\<exists>pc\<^sub>1. (pc + size (compE\<^sub>2 e)) \<le> pc\<^sub>1 \<and> pc\<^sub>1 < pc + size (compE\<^sub>2 e) + size(compE\<^sub>2 e') \<and>
                \<not> caught (compP\<^sub>2 P) pc\<^sub>1 h\<^sub>2 xa (compxE\<^sub>2 e' (pc + size (compE\<^sub>2 e)) (size (v\<^sub>1#vs))) \<and>
                (\<exists>vs'. (compP\<^sub>2 P) \<turnstile> (None,h\<^sub>1,(v\<^sub>1#vs,ls\<^sub>1,C,M,pc + size (compE\<^sub>2 e),ics)#frs,sh\<^sub>1)
                                    -jvm\<rightarrow> handle (compP\<^sub>2 P) C M xa h\<^sub>2 (vs'@v\<^sub>1#vs) ls\<^sub>2 pc\<^sub>1 ics frs sh\<^sub>2)))"
 proof -
   show ?thesis using assms nsub_RI_Jcc_pieces[where e=e'] by clarsimp
 qed
 
 lemma Jcc_pieces_SFAss:
 assumes
  "Jcc_pieces P E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h' ls' sh' v xa (C'\<bullet>\<^sub>sF{D}:=e)
    = (True, frs\<^sub>0, (xp',h',(v#vs',ls',C\<^sub>0,M',pc',ics')#frs',sh'), err)"
 shows "\<exists>err. Jcc_pieces P E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v' xa e
    = (True, frs\<^sub>0, (xp',h\<^sub>1,(v'#vs',ls\<^sub>1,C\<^sub>0,M',pc' - 2,ics')#frs',sh\<^sub>1), err)"
 proof -
   have pc: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> I" using assms by clarsimp
   show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] pc by clarsimp
 qed
 
 lemma Jcc_pieces_Call1:
 assumes
  "Jcc_pieces P E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>3 ls\<^sub>3 sh\<^sub>3 v xa (e\<bullet>M\<^sub>0(es))
    = (True, frs\<^sub>0, (xp',h',(v#vs',ls',C',M',pc',ics')#frs',sh'), err)"
 shows "\<exists>err. Jcc_pieces P E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0
     (I - pcs (compxEs\<^sub>2 es (pc + length (compE\<^sub>2 e)) (Suc (length vs')))) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v' xa e
    = (True, frs\<^sub>0,
        (xp',h\<^sub>1,(v'#vs',ls\<^sub>1,C',M',pc' - size (compEs\<^sub>2 es) - 1,ics')#frs',sh\<^sub>1), err)"
 proof -
   show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] by clarsimp
 qed
 
 lemma Jcc_pieces_clinit:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
   and cond: "Jcc_cond P\<^sub>1 E C M vs pc ics I h sh (C1\<bullet>\<^sub>sclinit([]))"
 shows "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (C1\<bullet>\<^sub>sclinit([]))
      = (True, create_init_frame P C1 # (vs,ls,C,M,pc,ics)#frs,
           (None, h', (vs,ls,C,M,pc,ics)#frs, sh'(C1\<mapsto>(fst(the(sh' C1)),Done))), 
       P \<turnstile> (None,h,create_init_frame P C1 # (vs,ls,C,M,pc,ics)#frs,sh) -jvm\<rightarrow>
      (case ics of Called Cs \<Rightarrow> (None,h',(vs,ls,C,M,pc,Throwing Cs xa)#frs,(sh'(C1 \<mapsto> (fst(the(sh' C1)),Error))))))"
 using assms by(auto split: init_call_status.splits list.splits bool.splits)
 
 lemma Jcc_pieces_SCall_clinit_body:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1" and wf: "wf_J\<^sub>1_prog P\<^sub>1"
  and "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>3 ls\<^sub>2 sh\<^sub>3 v xa (C1\<bullet>\<^sub>sclinit([]))
          = (True, frs', rhs', err')"
  and method: "P\<^sub>1 \<turnstile> C1 sees clinit,Static: []\<rightarrow>Void = body in D"
 shows "Jcc_pieces P\<^sub>1 [] D clinit h\<^sub>2 [] (replicate (max_vars body) undefined) 0
           No_ics (tl frs') sh\<^sub>2 {..<length (compE\<^sub>2 body)} h\<^sub>3 ls\<^sub>3 sh\<^sub>3 v xa body
            = (True, frs', 
                 (None,h\<^sub>3,([v],ls\<^sub>3,D,clinit,size(compE\<^sub>2 body), No_ics)#tl frs',sh\<^sub>3),
                     \<exists>pc\<^sub>1. 0 \<le> pc\<^sub>1 \<and> pc\<^sub>1 < size(compE\<^sub>2 body) \<and>
                       \<not> caught P pc\<^sub>1 h\<^sub>3 xa (compxE\<^sub>2 body 0 0) \<and>
                       (\<exists>vs'. P \<turnstile> (None,h\<^sub>2,frs',sh\<^sub>2) -jvm\<rightarrow> handle P D clinit xa h\<^sub>3 vs' ls\<^sub>3 pc\<^sub>1
                             No_ics (tl frs') sh\<^sub>3))"
 proof -
   have M_in_D: "P\<^sub>1 \<turnstile> D sees clinit,Static: []\<rightarrow>Void = body in D"
     using method by(rule sees_method_idemp) 
   hence M_code: "compP\<^sub>2 P\<^sub>1,D,clinit,0 \<rhd> compE\<^sub>2 body @ [Return]"
     and M_xtab: "compP\<^sub>2 P\<^sub>1,D,clinit \<rhd> compxE\<^sub>2 body 0 0/{..<size(compE\<^sub>2 body)},0"
     by(rule beforeM, rule beforexM)
   have nsub: "\<not>sub_RI body" by(rule sees_wf\<^sub>1_nsub_RI[OF wf method])
   then show ?thesis using assms nsub_RI_Jcc_pieces M_code M_xtab by clarsimp
 qed
 
 lemma Jcc_pieces_Cons:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
  and "P,C,M,pc \<rhd> compEs\<^sub>2 (e#es)" and "P,C,M \<rhd> compxEs\<^sub>2 (e#es) pc (size vs)/I,size vs"
  and "{pc..<pc+size(compEs\<^sub>2 (e#es))} \<subseteq> I"
  and "ics = No_ics"
  and "\<not>sub_RIs (e#es)"
 shows "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh
   (I - pcs (compxEs\<^sub>2 es (pc + length (compE\<^sub>2 e)) (Suc (length vs)))) h' ls' sh' v xa e
   = (True, (vs, ls, C, M, pc, ics) # frs,
         (None, h', (v#vs, ls', C, M, pc + length (compE\<^sub>2 e), ics) # frs, sh'),
           \<exists>pc\<^sub>1\<ge>pc. pc\<^sub>1 < pc + length (compE\<^sub>2 e) \<and> \<not> caught P pc\<^sub>1 h' xa (compxE\<^sub>2 e pc (length vs))
                    \<and> (\<exists>vs'. P \<turnstile> (None, h, (vs, ls, C, M, pc, ics) # frs, sh)
                          -jvm\<rightarrow> handle P C M xa h' (vs'@vs) ls' pc\<^sub>1 ics frs sh'))"
 proof -
   show ?thesis using assms nsub_RI_Jcc_pieces[where e=e] by auto
 qed
 
 lemma Jcc_pieces_InitNone:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
  and "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)"
 shows
  "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs (sh(C\<^sub>0 \<mapsto> (sblank P C\<^sub>0, Prepared)))
      I h' l' sh' v xa (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'),
         \<exists>vs'. P \<turnstile> (None,h,frs',(sh(C\<^sub>0 \<mapsto> (sblank P\<^sub>1 C\<^sub>0, Prepared))))
             -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh')"
 proof -
   have  "Jcc_cond P\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)" using assms by simp
   then obtain T where "P\<^sub>1,E,h,sh \<turnstile>\<^sub>1 INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> unit : T" by fastforce
   then have "P\<^sub>1,E,h,sh(C\<^sub>0 \<mapsto> (sblank P\<^sub>1 C\<^sub>0, Prepared)) \<turnstile>\<^sub>1 INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> unit : T"
     by(auto simp: fun_upd_apply)
   then have "Ex (WTrt2\<^sub>1 P\<^sub>1 E h (sh(C\<^sub>0 \<mapsto> (sblank P\<^sub>1 C\<^sub>0, Prepared))) (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> unit))"
     by(simp only: exI)
   then show ?thesis using assms by clarsimp
 qed
 
 lemma Jcc_pieces_InitDP:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
  and "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)"
 shows
  "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (Cs,True) \<leftarrow> e)
     = (True, (calling_to_scalled (hd frs'))#(tl frs'),
          (None, h', (vs, l, C, M, pc, Called []) # frs, sh'),
              \<exists>vs'. P \<turnstile> (None,h,calling_to_scalled (hd frs')#(tl frs'),sh)
                         -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh')"
 proof -
   have "Jcc_cond P\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)" using assms by simp
   then obtain T where "P\<^sub>1,E,h,sh \<turnstile>\<^sub>1 INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> unit : T" by fastforce
   then have "P\<^sub>1,E,h,sh \<turnstile>\<^sub>1 INIT C' (Cs,True) \<leftarrow> unit : T"
     by (auto; metis list.sel(2) list.set_sel(2))
   then have wtrt: "Ex (WTrt2\<^sub>1 P\<^sub>1 E h sh (INIT C' (Cs,True) \<leftarrow> unit))" by(simp only: exI)
   show ?thesis using assms wtrt
   proof(cases Cs)
     case (Cons C1 Cs1)
     then show ?thesis using assms wtrt
       by(case_tac "method P C1 clinit") clarsimp
   qed(clarsimp)
 qed
 
 lemma Jcc_pieces_InitError:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
  and "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)"
  and err: "sh C\<^sub>0 = Some(sfs,Error)"
 shows
  "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (RI (C\<^sub>0, THROW NoClassDefFoundError);Cs \<leftarrow> e)
     = (True, (calling_to_throwing (hd frs') (addr_of_sys_xcpt NoClassDefFoundError))#(tl frs'),
          (None, h', (vs, l, C, M, pc, Called []) # frs, sh'),
              \<exists>vs'. P \<turnstile> (None,h, (calling_to_throwing (hd frs') (addr_of_sys_xcpt NoClassDefFoundError))#(tl frs'),sh)
                         -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh')"
 proof -
   show ?thesis using assms
   proof(cases Cs)
     case (Cons C1 Cs1)
     then show ?thesis using assms
       by(case_tac "method P C1 clinit", case_tac "method P C\<^sub>0 clinit") clarsimp
   qed(clarsimp)
 qed
 
 lemma Jcc_pieces_InitObj:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
  and "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' (sh(C\<^sub>0 \<mapsto> (sfs,Processing))) v xa (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)"
 shows
  "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs (sh(C\<^sub>0 \<mapsto> (sfs,Processing))) I h' l' sh'' v xa (INIT C' (C\<^sub>0 # Cs,True) \<leftarrow> e)
     = (True, calling_to_called (hd frs')#(tl frs'),
          (None, h', (vs, l, C, M, pc, Called []) # frs, sh''),
              \<exists>vs'. P \<turnstile> (None,h,calling_to_called (hd frs')#(tl frs'),sh')
                         -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'')"
 proof -
   have "Jcc_cond P\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)" using assms by simp
   then obtain T where "P\<^sub>1,E,h,sh \<turnstile>\<^sub>1 INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> unit : T" by fastforce
   then have "P\<^sub>1,E,h,sh(C\<^sub>0 \<mapsto> (sfs,Processing)) \<turnstile>\<^sub>1 INIT C' (C\<^sub>0 # Cs,True) \<leftarrow> unit : T"
     using assms by clarsimp (auto simp: fun_upd_apply)
   then have wtrt: "Ex (WTrt2\<^sub>1 P\<^sub>1 E h (sh(C\<^sub>0 \<mapsto> (sfs,Processing))) (INIT C' (C\<^sub>0 # Cs,True) \<leftarrow> unit))"
     by(simp only: exI)
   show ?thesis using assms wtrt by clarsimp
 qed
 
 lemma Jcc_pieces_InitNonObj:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
  and "is_class P\<^sub>1 D" and "D \<notin> set (C\<^sub>0#Cs)" and "\<forall>C \<in> set (C\<^sub>0#Cs). P\<^sub>1 \<turnstile> C \<preceq>\<^sup>* D"
  and pcs: "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' (sh(C\<^sub>0 \<mapsto> (sfs,Processing))) v xa (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)"
 shows
  "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs (sh(C\<^sub>0 \<mapsto> (sfs,Processing))) I h' l' sh'' v xa (INIT C' (D # C\<^sub>0 # Cs,False) \<leftarrow> e)
     = (True, calling_to_calling (hd frs') D#(tl frs'),
          (None, h', (vs, l, C, M, pc, Called []) # frs, sh''),
              \<exists>vs'. P \<turnstile> (None,h,calling_to_calling (hd frs') D#(tl frs'),sh')
                         -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'')"
 proof -
   have "Jcc_cond P\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)" using assms by simp
   then obtain T where "P\<^sub>1,E,h,sh \<turnstile>\<^sub>1 INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> unit : T" by fastforce
   then have "P\<^sub>1,E,h,sh(C\<^sub>0 \<mapsto> (sfs,Processing)) \<turnstile>\<^sub>1 INIT C' (D # C\<^sub>0 # Cs,False) \<leftarrow> unit : T"
     using assms by clarsimp (auto simp: fun_upd_apply)
   then have wtrt: "Ex (WTrt2\<^sub>1 P\<^sub>1 E h (sh(C\<^sub>0 \<mapsto> (sfs,Processing))) (INIT C' (D # C\<^sub>0 # Cs,False) \<leftarrow> unit))"
     by(simp only: exI)
   show ?thesis using assms wtrt by clarsimp
 qed
 
 lemma Jcc_pieces_InitRInit:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1" and wf: "wf_J\<^sub>1_prog P\<^sub>1"
  and "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (INIT C' (C\<^sub>0 # Cs,True) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)"
 shows
  "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa (RI (C\<^sub>0,C\<^sub>0\<bullet>\<^sub>sclinit([])) ; Cs \<leftarrow> e)
     = (True, frs',
          (None, h', (vs, l, C, M, pc, Called []) # frs, sh'),
              \<exists>vs'. P \<turnstile> (None,h,frs',sh)
                         -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh')"
 proof -
   have cond: "Jcc_cond P\<^sub>1 E C M vs pc ics I h sh (INIT C' (C\<^sub>0 # Cs,True) \<leftarrow> e)" using assms by simp
   then have clinit: "\<exists>T. P\<^sub>1,E,h,sh \<turnstile>\<^sub>1 C\<^sub>0\<bullet>\<^sub>sclinit([]) : T" using wf
     by clarsimp (auto simp: is_class_def intro: wf\<^sub>1_types_clinit)
   then obtain T where cT: "P\<^sub>1,E,h,sh \<turnstile>\<^sub>1 C\<^sub>0\<bullet>\<^sub>sclinit([]) : T" by blast
   obtain T where "P\<^sub>1,E,h,sh \<turnstile>\<^sub>1 INIT C' (C\<^sub>0 # Cs,True) \<leftarrow> unit : T" using cond by fastforce
   then have "P\<^sub>1,E,h,sh \<turnstile>\<^sub>1 RI (C\<^sub>0,C\<^sub>0\<bullet>\<^sub>sclinit([])) ; Cs \<leftarrow> unit : T"
     using assms by (auto intro: cT)
   then have wtrt: "Ex (WTrt2\<^sub>1 P\<^sub>1 E h sh (RI (C\<^sub>0,C\<^sub>0\<bullet>\<^sub>sclinit([])) ; Cs \<leftarrow> unit))"
     by(simp only: exI)
   then show ?thesis using assms by simp
 qed
 
 lemma Jcc_pieces_RInit_clinit:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1" and wf: "wf_J\<^sub>1_prog P\<^sub>1"
  and "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h\<^sub>1 l\<^sub>1 sh\<^sub>1 v xa (RI (C\<^sub>0,C\<^sub>0\<bullet>\<^sub>sclinit([]));Cs \<leftarrow> e)
     = (True, frs',
          (None, h\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\<^sub>1), err)"
 shows
  "Jcc_pieces P\<^sub>1 E C M h vs l pc (Called Cs) (tl frs') sh I h' l' sh' v xa (C\<^sub>0\<bullet>\<^sub>sclinit([]))
     = (True, create_init_frame P C\<^sub>0#(vs,l,C,M,pc,Called Cs)#tl frs',
          (None, h', (vs,l,C,M,pc,Called Cs)#tl frs', sh'(C\<^sub>0\<mapsto>(fst(the(sh' C\<^sub>0)),Done))),
              P \<turnstile> (None,h,create_init_frame P C\<^sub>0#(vs,l,C,M,pc,Called Cs)#tl frs',sh)
    -jvm\<rightarrow> (None,h',(vs, l, C, M, pc, Throwing Cs xa) # tl frs',sh'(C\<^sub>0 \<mapsto> (fst(the(sh' C\<^sub>0)),Error))))"
 proof -
   have cond: "Jcc_cond P\<^sub>1 E C M vs pc ics I h sh (RI (C\<^sub>0,C\<^sub>0\<bullet>\<^sub>sclinit([]));Cs \<leftarrow> e)" using assms by simp
   then have wtrt: "\<exists>T. P\<^sub>1,E,h,sh \<turnstile>\<^sub>1 C\<^sub>0\<bullet>\<^sub>sclinit([]) : T" using wf
     by clarsimp (auto simp: is_class_def intro: wf\<^sub>1_types_clinit)
   then show ?thesis using assms by clarsimp
 qed
 
 lemma Jcc_pieces_RInit_Init:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1" and wf: "wf_J\<^sub>1_prog P\<^sub>1"
  and proc: "\<forall>C' \<in> set Cs. \<exists>sfs. sh'' C' = \<lfloor>(sfs,Processing)\<rfloor>"
  and "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h\<^sub>1 l\<^sub>1 sh\<^sub>1 v xa (RI (C\<^sub>0,C\<^sub>0\<bullet>\<^sub>sclinit([]));Cs \<leftarrow> e)
     = (True, frs',
          (None, h\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\<^sub>1), err)"
 shows
  "Jcc_pieces P\<^sub>1 E C M h' vs l pc ics frs sh'' I h\<^sub>1 l\<^sub>1 sh\<^sub>1 v xa (INIT (last (C\<^sub>0#Cs)) (Cs,True) \<leftarrow> e)
     = (True, (vs, l, C, M, pc, Called Cs) # frs,
          (None, h\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\<^sub>1),
              \<exists>vs'. P \<turnstile> (None,h',(vs, l, C, M, pc, Called Cs) # frs,sh'')
                         -jvm\<rightarrow> handle P C M xa h\<^sub>1 (vs'@vs) l pc ics frs sh\<^sub>1)"
 proof -
   have "Jcc_cond P\<^sub>1 E C M vs pc ics I h sh (RI (C\<^sub>0,C\<^sub>0\<bullet>\<^sub>sclinit([]));Cs \<leftarrow> e)" using assms by simp
   then have "Ex (WTrt2\<^sub>1 P\<^sub>1 E h sh (RI (C\<^sub>0,C\<^sub>0\<bullet>\<^sub>sclinit([])) ; Cs \<leftarrow> unit))" by simp
   then obtain T where riwt: "P\<^sub>1,E,h,sh \<turnstile>\<^sub>1 RI (C\<^sub>0,C\<^sub>0\<bullet>\<^sub>sclinit([]));Cs \<leftarrow> unit : T" by meson
   then have "P\<^sub>1,E,h',sh'' \<turnstile>\<^sub>1 INIT (last (C\<^sub>0#Cs)) (Cs,True) \<leftarrow> unit : T" using proc
   proof(cases Cs) qed(auto)
   then have wtrt: "Ex (WTrt2\<^sub>1 P\<^sub>1 E h' sh'' (INIT (last (C\<^sub>0#Cs)) (Cs,True) \<leftarrow> unit))" by(simp only: exI)
   show ?thesis using assms wtrt
   proof(cases Cs)
     case (Cons C1 Cs1)
     then show ?thesis using assms wtrt
       by(case_tac "method P C1 clinit") clarsimp
   qed(clarsimp)
 qed
 
 lemma Jcc_pieces_RInit_RInit:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
  and "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h\<^sub>1 l\<^sub>1 sh\<^sub>1 v xa (RI (C\<^sub>0,e);D#Cs \<leftarrow> e')
     = (True, frs', rhs, err)"
  and hd: "hd frs' = (vs1,l1,C1,M1,pc1,ics1)"
 shows
  "Jcc_pieces P\<^sub>1 E C M h' vs l pc ics frs sh'' I h\<^sub>1 l\<^sub>1 sh\<^sub>1 v xa (RI (D,Throw xa) ; Cs \<leftarrow> e')
     = (True, (vs1, l1, C1, M1, pc1, Throwing (D#Cs) xa) # tl frs',
          (None, h\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\<^sub>1),
              \<exists>vs'. P \<turnstile> (None,h',(vs1, l1, C1, M1, pc1, Throwing (D#Cs) xa) # tl frs',sh'')
                         -jvm\<rightarrow> handle P C M xa h\<^sub>1 (vs'@vs) l pc ics frs sh\<^sub>1)"
 using assms by(case_tac "method P D clinit", cases "e = C\<^sub>0\<bullet>\<^sub>sclinit([])") clarsimp+
 
 
 subsubsection "JVM stepping lemmas"
 
 lemma jvm_Invoke:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
  and "P,C,M,pc \<triangleright> Invoke M' (length Ts)"
  and ha: "h\<^sub>2 a = \<lfloor>(Ca, fs)\<rfloor>" and method: "P\<^sub>1 \<turnstile> Ca sees M', NonStatic :  Ts\<rightarrow>T = body in D"
  and len: "length pvs = length Ts" and "ls\<^sub>2' = Addr a # pvs @ replicate (max_vars body) undefined"
 shows "P \<turnstile> (None, h\<^sub>2, (rev pvs @ Addr a # vs, ls\<^sub>2, C, M, pc, No_ics) # frs, sh\<^sub>2) -jvm\<rightarrow>
     (None, h\<^sub>2, ([], ls\<^sub>2', D, M', 0, No_ics) # (rev pvs @ Addr a # vs, ls\<^sub>2, C, M, pc, No_ics) # frs, sh\<^sub>2)"
 proof -
   have cname: "cname_of h\<^sub>2 (the_Addr ((rev pvs @ Addr a # vs) ! length Ts)) = Ca"
     using ha method len by(auto simp: nth_append)
   have r: "(rev pvs @ Addr a # vs) ! (length Ts) = Addr a" using len by(auto simp: nth_append)
   have exm: "\<exists>Ts T m D b. P \<turnstile> Ca sees M',b:Ts \<rightarrow> T = m in D"
     using sees_method_compP[OF method] by fastforce
   show ?thesis using assms cname r exm by simp
 qed
 
 lemma jvm_Invokestatic:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
  and "P,C,M,pc \<triangleright> Invokestatic C' M' (length Ts)"
  and sh: "sh\<^sub>2 D = Some(sfs,Done)"
  and method: "P\<^sub>1 \<turnstile> C' sees M', Static :  Ts\<rightarrow>T = body in D"
  and len: "length pvs = length Ts" and "ls\<^sub>2' = pvs @ replicate (max_vars body) undefined"
 shows "P \<turnstile> (None, h\<^sub>2, (rev pvs @ vs, ls\<^sub>2, C, M, pc, No_ics) # frs, sh\<^sub>2) -jvm\<rightarrow>
     (None, h\<^sub>2, ([], ls\<^sub>2', D, M', 0, No_ics) # (rev pvs @ vs, ls\<^sub>2, C, M, pc, No_ics) # frs, sh\<^sub>2)"
 proof -
   have exm: "\<exists>Ts T m D b. P \<turnstile> C' sees M',b:Ts \<rightarrow> T = m in D"
     using sees_method_compP[OF method] by fastforce
   show ?thesis using assms exm by simp
 qed
 
 lemma jvm_Invokestatic_Called:
 assumes [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"                       
  and "P,C,M,pc \<triangleright> Invokestatic C' M' (length Ts)"
  and sh: "sh\<^sub>2 D = Some(sfs,i)"
  and method: "P\<^sub>1 \<turnstile> C' sees M', Static :  Ts\<rightarrow>T = body in D"
  and len: "length pvs = length Ts" and "ls\<^sub>2' = pvs @ replicate (max_vars body) undefined"
 shows "P \<turnstile> (None, h\<^sub>2, (rev pvs @ vs, ls\<^sub>2, C, M, pc, Called []) # frs, sh\<^sub>2) -jvm\<rightarrow>
     (None, h\<^sub>2, ([], ls\<^sub>2', D, M', 0, No_ics) # (rev pvs @ vs, ls\<^sub>2, C, M, pc, No_ics) # frs, sh\<^sub>2)"
 proof -
   have exm: "\<exists>Ts T m D b. P \<turnstile> C' sees M',b:Ts \<rightarrow> T = m in D"
     using sees_method_compP[OF method] by fastforce
   show ?thesis using assms exm by simp
 qed
 
 lemma jvm_Return_Init:
 "P,D,clinit,0 \<rhd> compE\<^sub>2 body @ [Return]
   \<Longrightarrow> P \<turnstile> (None, h, (vs, ls, D, clinit, size(compE\<^sub>2 body), No_ics) # frs, sh)
               -jvm\<rightarrow> (None, h, frs, sh(D\<mapsto>(fst(the(sh D)),Done)))"
-apply(simp add: exec_all_def1, rule r_into_rtrancl, rule exec_1I)
-apply(cases frs, auto)
-done
+(is "?P \<Longrightarrow> P \<turnstile> ?s1 -jvm\<rightarrow> ?s2")
+proof -
+  assume ?P
+  then have "exec (P, ?s1) = \<lfloor>?s2\<rfloor>" by(cases frs) auto
+  then have "(?s1, ?s2) \<in> (exec_1 P)\<^sup>*"
+    by(rule exec_1I[THEN r_into_rtrancl])
+  then show ?thesis by(simp add: exec_all_def1)
+qed
 
 lemma jvm_InitNone:
  "\<lbrakk> ics_of f = Calling C Cs;
     sh C = None \<rbrakk>
   \<Longrightarrow> P \<turnstile> (None,h,f#frs,sh) -jvm\<rightarrow> (None,h,f#frs,sh(C \<mapsto> (sblank P C, Prepared)))"
-apply(simp add: exec_all_def1, rule r_into_rtrancl, rule exec_1I)
-apply(cases f) apply(rename_tac ics, case_tac ics, simp_all)
-done
+(is "\<lbrakk> ?P; ?Q \<rbrakk> \<Longrightarrow> P \<turnstile> ?s1 -jvm\<rightarrow> ?s2")
+proof -
+  assume assms: ?P ?Q
+  then obtain stk1 loc1 C1 M1 pc1 ics1 where "f = (stk1,loc1,C1,M1,pc1,ics1)"
+    by(cases f) simp
+  then have "exec (P, ?s1) = \<lfloor>?s2\<rfloor>" using assms
+    by(case_tac ics1) simp_all
+  then have "(?s1, ?s2) \<in> (exec_1 P)\<^sup>*"
+    by(rule exec_1I[THEN r_into_rtrancl])
+  then show ?thesis by(simp add: exec_all_def1)
+qed
 
 lemma jvm_InitDP:
  "\<lbrakk> ics_of f = Calling C Cs;
     sh C = \<lfloor>(sfs,i)\<rfloor>; i = Done \<or> i = Processing \<rbrakk>
   \<Longrightarrow> P \<turnstile> (None,h,f#frs,sh) -jvm\<rightarrow> (None,h,(calling_to_scalled f)#frs,sh)"
-apply(simp add: exec_all_def1, rule r_into_rtrancl, rule exec_1I)
-apply(cases f)
-apply(erule_tac P = "i = Done" in disjE)
- apply simp_all
-done
+(is "\<lbrakk> ?P; ?Q; ?R \<rbrakk> \<Longrightarrow> P \<turnstile> ?s1 -jvm\<rightarrow> ?s2")
+proof -
+  assume assms: ?P ?Q ?R
+  then obtain stk1 loc1 C1 M1 pc1 ics1 where "f = (stk1,loc1,C1,M1,pc1,ics1)"
+    by(cases f) simp
+  then have "exec (P, ?s1) = \<lfloor>?s2\<rfloor>" using assms
+    by(case_tac i) simp_all
+  then have "(?s1, ?s2) \<in> (exec_1 P)\<^sup>*"
+    by(rule exec_1I[THEN r_into_rtrancl])
+  then show ?thesis by(simp add: exec_all_def1)
+qed
 
 lemma jvm_InitError:
  "sh C = \<lfloor>(sfs,Error)\<rfloor>
   \<Longrightarrow> P \<turnstile> (None,h,(vs,ls,C\<^sub>0,M,pc,Calling C Cs)#frs,sh)
    -jvm\<rightarrow> (None,h,(vs,ls,C\<^sub>0,M,pc,Throwing Cs (addr_of_sys_xcpt NoClassDefFoundError))#frs,sh)"
  by(clarsimp simp: exec_all_def1 intro!: r_into_rtrancl exec_1I)
 
 lemma exec_ErrorThrowing:
  "sh C = \<lfloor>(sfs,Error)\<rfloor>
   \<Longrightarrow> exec (P, (None,h,calling_to_throwing (stk,loc,D,M,pc,Calling C Cs) a#frs,sh))
    = Some (None,h,calling_to_sthrowing (stk,loc,D,M,pc,Calling C Cs) a #frs,sh)"
  by(clarsimp simp: exec_all_def1 fun_upd_idem_iff intro!: r_into_rtrancl exec_1I)
 
 lemma jvm_InitObj:
  "\<lbrakk> sh C = Some(sfs,Prepared);
      C = Object;
      sh' = sh(C \<mapsto> (sfs,Processing)) \<rbrakk>
 \<Longrightarrow> P \<turnstile> (None, h, (vs,ls,C\<^sub>0,M,pc,Calling C Cs)#frs, sh) -jvm\<rightarrow>
     (None, h, (vs,ls,C\<^sub>0,M,pc,Called (C#Cs))#frs,sh')"
-apply(simp add: exec_all_def1, rule r_into_rtrancl, rule exec_1I)
-apply(case_tac "method P C clinit", simp)
-done
+(is "\<lbrakk> ?P; ?Q; ?R \<rbrakk> \<Longrightarrow> P \<turnstile> ?s1 -jvm\<rightarrow> ?s2")
+proof -
+  assume assms: ?P ?Q ?R
+  then have "exec (P, ?s1) = \<lfloor>?s2\<rfloor>"
+    by(case_tac "method P C clinit") simp
+  then have "(?s1, ?s2) \<in> (exec_1 P)\<^sup>*"
+    by(rule exec_1I[THEN r_into_rtrancl])
+  then show ?thesis by(simp add: exec_all_def1)
+qed
 
 lemma jvm_InitNonObj:
  "\<lbrakk> sh C = Some(sfs,Prepared);
      C \<noteq> Object;
      class P C = Some (D,r);
      sh' = sh(C \<mapsto> (sfs,Processing)) \<rbrakk>
 \<Longrightarrow> P \<turnstile> (None, h, (vs,ls,C\<^sub>0,M,pc,Calling C Cs)#frs, sh) -jvm\<rightarrow>
     (None, h, (vs,ls,C\<^sub>0,M,pc,Calling D (C#Cs))#frs, sh')"
-apply(simp add: exec_all_def1, rule r_into_rtrancl, rule exec_1I)
-apply(case_tac "method P C clinit", simp)
-done
+(is "\<lbrakk> ?P; ?Q; ?R; ?S \<rbrakk> \<Longrightarrow> P \<turnstile> ?s1 -jvm\<rightarrow> ?s2")
+proof -
+  assume assms: ?P ?Q ?R ?S
+  then have "exec (P, ?s1) = \<lfloor>?s2\<rfloor>"
+    by(case_tac "method P C clinit") simp
+  then have "(?s1, ?s2) \<in> (exec_1 P)\<^sup>*"
+    by(rule exec_1I[THEN r_into_rtrancl])
+  then show ?thesis by(simp add: exec_all_def1)
+qed
 
 lemma jvm_RInit_throw:
  "P \<turnstile> (None,h,(vs,l,C,M,pc,Throwing [] xa) # frs,sh)
         -jvm\<rightarrow> handle P C M xa h vs l pc No_ics frs sh"
-apply(simp add: exec_all_def1, rule r_into_rtrancl, rule exec_1I)
-apply(simp add: handle_def split: bool.splits)
-done
+(is "P \<turnstile> ?s1 -jvm\<rightarrow> ?s2")
+proof -
+  have "exec (P, ?s1) = \<lfloor>?s2\<rfloor>"
+    by(simp add: handle_def split: bool.splits)
+  then have "(?s1, ?s2) \<in> (exec_1 P)\<^sup>*"
+    by(rule exec_1I[THEN r_into_rtrancl])
+  then show ?thesis by(simp add: exec_all_def1)
+qed
 
 lemma jvm_RInit_throw':
  "P \<turnstile> (None,h,(vs,l,C,M,pc,Throwing [C'] xa) # frs,sh)
         -jvm\<rightarrow> handle P C M xa h vs l pc No_ics frs (sh(C':=Some(fst(the(sh C')), Error)))"
-apply(simp add: exec_all_def1)
-apply(rule_tac y = "(None,h,(vs,l,C,M,pc,Throwing [] xa) # frs,sh(C':=Some(fst(the(sh C')), Error)))" in rtrancl_trans)
- apply(rule r_into_rtrancl, rule exec_1I)
- apply(simp add: handle_def)
-apply(cut_tac jvm_RInit_throw)
-apply(simp add: exec_all_def1)
-done
+(is "P \<turnstile> ?s1 -jvm\<rightarrow> ?s2")
+proof -
+  let ?sy = "(None,h,(vs,l,C,M,pc,Throwing [] xa) # frs,sh(C':=Some(fst(the(sh C')), Error)))"
+  have "exec (P, ?s1) = \<lfloor>?sy\<rfloor>" by simp
+  then have "(?s1, ?sy) \<in> (exec_1 P)\<^sup>*"
+    by(rule exec_1I[THEN r_into_rtrancl])
+  also have "(?sy, ?s2) \<in> (exec_1 P)\<^sup>*"
+    using jvm_RInit_throw by(simp add: exec_all_def1)
+  ultimately show ?thesis by(simp add: exec_all_def1)
+qed
 
 lemma jvm_Called:
  "P \<turnstile> (None, h, (vs, l, C, M, pc, Called (C\<^sub>0 # Cs)) # frs, sh) -jvm\<rightarrow>
     (None, h, create_init_frame P C\<^sub>0 # (vs, l, C, M, pc, Called Cs) # frs, sh)"
  by(simp add: exec_all_def1 r_into_rtrancl exec_1I)
 
 lemma jvm_Throwing:
  "P \<turnstile> (None, h, (vs, l, C, M, pc, Throwing (C\<^sub>0#Cs) xa') # frs, sh) -jvm\<rightarrow>
     (None, h, (vs, l, C, M, pc, Throwing Cs xa') # frs, sh(C\<^sub>0 \<mapsto> (fst (the (sh C\<^sub>0)), Error)))"
  by(simp add: exec_all_def1 r_into_rtrancl exec_1I)
 
 subsubsection "Other lemmas for correctness proof"
 
 lemma assumes wf:"wf_prog wf_md P"
  and ex: "class P C = Some a"
 shows create_init_frame_wf_eq: "create_init_frame (compP\<^sub>2 P) C = (stk,loc,D,M,pc,ics) \<Longrightarrow> D=C"
 using wf_sees_clinit[OF wf ex] by(cases "method P C clinit", auto)
 
 lemma beforex_try:
- "\<lbrakk> {pc..<pc+size(compE\<^sub>2(try e\<^sub>1 catch(Ci i) e\<^sub>2))} \<subseteq> I;
-    P,C,M \<rhd> compxE\<^sub>2 (try e\<^sub>1 catch(Ci i) e\<^sub>2) pc (size vs) / I,size vs \<rbrakk>
-   \<Longrightarrow> P,C,M \<rhd> compxE\<^sub>2 e\<^sub>1 pc (size vs) / {pc..<pc + length (compE\<^sub>2 e\<^sub>1)},size vs"
-apply(clarsimp simp:beforex_def split:if_split_asm)
-apply(rename_tac xt\<^sub>0 xt\<^sub>1) apply(rule_tac x=xt\<^sub>0 in exI)
-apply(auto simp: pcs_subset(1))
-using atLeastLessThan_iff by blast
+assumes pcI: "{pc..<pc+size(compE\<^sub>2(try e\<^sub>1 catch(Ci i) e\<^sub>2))} \<subseteq> I"
+  and bx: "P,C,M \<rhd> compxE\<^sub>2 (try e\<^sub>1 catch(Ci i) e\<^sub>2) pc (size vs) / I,size vs"
+shows "P,C,M \<rhd> compxE\<^sub>2 e\<^sub>1 pc (size vs) / {pc..<pc + length (compE\<^sub>2 e\<^sub>1)},size vs"
+proof -
+  obtain xt\<^sub>0 xt\<^sub>1 where
+   "beforex\<^sub>0 P C M (size vs) I (compxE\<^sub>2 (try e\<^sub>1 catch(Ci i) e\<^sub>2) pc (size vs)) xt\<^sub>0 xt\<^sub>1"
+    using bx by(clarsimp simp:beforex_def)
+  then have "\<exists>xt1. beforex\<^sub>0 P C M (size vs) {pc..<pc + length (compE\<^sub>2 e\<^sub>1)}
+                   (compxE\<^sub>2 e\<^sub>1 pc (size vs)) xt\<^sub>0 xt1"
+    using pcI pcs_subset(1) atLeastLessThan_iff by simp blast
+  then show ?thesis using beforex_def by blast
+qed
 
 \<comment> \<open> Evaluation of initialization expressions \<close>
 
 (* --needs J1 and EConform; version for eval found in Equivalence *)
 lemma
 shows eval\<^sub>1_init_return: "P \<turnstile>\<^sub>1 \<langle>e,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>
   \<Longrightarrow> iconf (shp\<^sub>1 s) e
   \<Longrightarrow> (\<exists>Cs b. e = INIT C' (Cs,b) \<leftarrow> unit) \<or> (\<exists>C e\<^sub>0 Cs e\<^sub>i. e = RI(C,e\<^sub>0);Cs@[C'] \<leftarrow> unit)
      \<or> (\<exists>e\<^sub>0. e = RI(C',e\<^sub>0);Nil \<leftarrow> unit)
   \<Longrightarrow> (val_of e' = Some v \<longrightarrow> (\<exists>sfs i. shp\<^sub>1 s' C' = \<lfloor>(sfs,i)\<rfloor> \<and> (i = Done \<or> i = Processing)))
    \<and> (throw_of e' = Some a \<longrightarrow> (\<exists>sfs i. shp\<^sub>1 s' C' = \<lfloor>(sfs,Error)\<rfloor>))"
 and "P \<turnstile>\<^sub>1 \<langle>es,s\<rangle> [\<Rightarrow>] \<langle>es',s'\<rangle> \<Longrightarrow> True"
 proof(induct rule: eval\<^sub>1_evals\<^sub>1.inducts)
   case (InitFinal\<^sub>1 e s e' s' C b) then show ?case
     by(auto simp: initPD_def dest: eval\<^sub>1_final_same)
 next
   case (InitDone\<^sub>1 sh C sfs C' Cs e h l e' s')
   then have "final e'" using eval\<^sub>1_final by simp
   then show ?case
   proof(rule finalE)
     fix v assume e': "e' = Val v" then show ?thesis using InitDone\<^sub>1 initPD_def
     proof(cases Cs) qed(auto)
   next
     fix a assume e': "e' = throw a" then show ?thesis using InitDone\<^sub>1 initPD_def
     proof(cases Cs) qed(auto)
   qed
 next
   case (InitProcessing\<^sub>1 sh C sfs C' Cs e h l e' s')
   then have "final e'" using eval\<^sub>1_final by simp
   then show ?case
   proof(rule finalE)
     fix v assume e': "e' = Val v" then show ?thesis using InitProcessing\<^sub>1 initPD_def
     proof(cases Cs) qed(auto)
   next
     fix a assume e': "e' = throw a" then show ?thesis using InitProcessing\<^sub>1 initPD_def
     proof(cases Cs) qed(auto)
   qed
 next
   case (InitError\<^sub>1 sh C sfs Cs e h l e' s' C') show ?case
   proof(cases Cs)
     case Nil then show ?thesis using InitError\<^sub>1 by simp
   next
     case (Cons C2 list)
     then have "final e'" using InitError\<^sub>1 eval\<^sub>1_final by simp
     then show ?thesis
     proof(rule finalE)
       fix v assume e': "e' = Val v" show ?thesis
         using InitError\<^sub>1.hyps(2) e' rinit\<^sub>1_throwE by blast
     next
       fix a assume e': "e' = throw a"
       then show ?thesis using Cons InitError\<^sub>1 cons_to_append[of list] by clarsimp
     qed
   qed
 next
   case (InitRInit\<^sub>1 C Cs h l sh e' s' C') show ?case
   proof(cases Cs)
     case Nil then show ?thesis using InitRInit\<^sub>1 by simp
   next
     case (Cons C' list) then show ?thesis
       using InitRInit\<^sub>1 Cons cons_to_append[of list] by clarsimp
   qed
 next
   case (RInit\<^sub>1 e s v h' l' sh' C sfs i sh'' C' Cs e' e\<^sub>1 s\<^sub>1)
   then have final: "final e\<^sub>1" using eval\<^sub>1_final by simp
   then show ?case
   proof(cases Cs)
     case Nil show ?thesis using final
     proof(rule finalE)
       fix v assume e': "e\<^sub>1 = Val v" show ?thesis
       using RInit\<^sub>1 Nil by(clarsimp, meson fun_upd_same initPD_def)
     next
       fix a assume e': "e\<^sub>1 = throw a" show ?thesis
       using RInit\<^sub>1 Nil by(clarsimp, meson fun_upd_same initPD_def)
     qed
   next
     case (Cons a list) show ?thesis using final
     proof(rule finalE)
       fix v assume e': "e\<^sub>1 = Val v" then show ?thesis
       using RInit\<^sub>1 Cons by(clarsimp, metis last.simps last_appendR list.distinct(1))
     next
       fix a assume e': "e\<^sub>1 = throw a" then show ?thesis
       using RInit\<^sub>1 Cons by(clarsimp, metis last.simps last_appendR list.distinct(1))
     qed
   qed
 next
   case (RInitInitFail\<^sub>1 e s a h' l' sh' C sfs i sh'' D Cs e' e\<^sub>1 s\<^sub>1)
   then have final: "final e\<^sub>1" using eval\<^sub>1_final by simp
   then show ?case
   proof(rule finalE)
     fix v assume e': "e\<^sub>1 = Val v" then show ?thesis
     using RInitInitFail\<^sub>1 by(clarsimp, meson exp.distinct(101) rinit\<^sub>1_throwE)
   next
     fix a' assume e': "e\<^sub>1 = Throw a'"
     then have "iconf (sh'(C \<mapsto> (sfs, Error))) a"
       using RInitInitFail\<^sub>1.hyps(1) eval\<^sub>1_final by fastforce
     then show ?thesis using RInitInitFail\<^sub>1 e'
       by(clarsimp, meson Cons_eq_append_conv list.inject)
   qed
 qed(auto simp: fun_upd_same)
 
 lemma init\<^sub>1_Val_PD: "P \<turnstile>\<^sub>1 \<langle>INIT C' (Cs,b) \<leftarrow> unit,s\<rangle> \<Rightarrow> \<langle>Val v,s'\<rangle>
   \<Longrightarrow> iconf (shp\<^sub>1 s) (INIT C' (Cs,b) \<leftarrow> unit)
   \<Longrightarrow> \<exists>sfs i. shp\<^sub>1 s' C' = \<lfloor>(sfs,i)\<rfloor> \<and> (i = Done \<or> i = Processing)"
  by(drule_tac v = v in eval\<^sub>1_init_return, simp+)
 
 lemma init\<^sub>1_throw_PD: "P \<turnstile>\<^sub>1 \<langle>INIT C' (Cs,b) \<leftarrow> unit,s\<rangle> \<Rightarrow> \<langle>throw a,s'\<rangle>
   \<Longrightarrow> iconf (shp\<^sub>1 s) (INIT C' (Cs,b) \<leftarrow> unit)
   \<Longrightarrow> \<exists>sfs i. shp\<^sub>1 s' C' = \<lfloor>(sfs,Error)\<rfloor>"
  by(drule_tac a = a in eval\<^sub>1_init_return, simp+)
 
-lemma rinit\<^sub>1_Val_PD: "P \<turnstile>\<^sub>1 \<langle>RI(C,e\<^sub>0);Cs \<leftarrow> unit,s\<rangle> \<Rightarrow> \<langle>Val v,s'\<rangle>
-  \<Longrightarrow> iconf (shp\<^sub>1 s) (RI(C,e\<^sub>0);Cs \<leftarrow> unit) \<Longrightarrow> last(C#Cs) = C'
-  \<Longrightarrow> \<exists>sfs i. shp\<^sub>1 s' C' = \<lfloor>(sfs,i)\<rfloor> \<and> (i = Done \<or> i = Processing)"
-apply(drule_tac C' = C' and v = v in eval\<^sub>1_init_return, simp_all)
-apply (metis append_butlast_last_id)
-done
+lemma rinit\<^sub>1_Val_PD:
+assumes eval: "P \<turnstile>\<^sub>1 \<langle>RI(C,e\<^sub>0);Cs \<leftarrow> unit,s\<rangle> \<Rightarrow> \<langle>Val v,s'\<rangle>"
+  and iconf: "iconf (shp\<^sub>1 s) (RI(C,e\<^sub>0);Cs \<leftarrow> unit)" and last: "last(C#Cs) = C'"
+shows "\<exists>sfs i. shp\<^sub>1 s' C' = \<lfloor>(sfs,i)\<rfloor> \<and> (i = Done \<or> i = Processing)"
+proof(cases Cs)
+  case Nil
+  then show ?thesis using eval\<^sub>1_init_return[OF eval iconf] last by simp
+next
+  case (Cons a list)
+  then have nNil: "Cs \<noteq> []" by simp
+  then have "\<exists>Cs'. Cs = Cs' @ [C']" using last append_butlast_last_id[OF nNil]
+    by(rule_tac x="butlast Cs" in exI) simp
+  then show ?thesis using eval\<^sub>1_init_return[OF eval iconf] by simp
+qed
 
-lemma rinit\<^sub>1_throw_PD: "P \<turnstile>\<^sub>1 \<langle>RI(C,e\<^sub>0);Cs \<leftarrow> unit,s\<rangle> \<Rightarrow> \<langle>throw a,s'\<rangle>
-  \<Longrightarrow> iconf (shp\<^sub>1 s) (RI(C,e\<^sub>0);Cs \<leftarrow> unit) \<Longrightarrow> last(C#Cs) = C'
-  \<Longrightarrow> \<exists>sfs i. shp\<^sub>1 s' C' = \<lfloor>(sfs,Error)\<rfloor>"
-apply(drule_tac C' = C' and a = a in eval\<^sub>1_init_return, simp_all)
-apply (metis append_butlast_last_id)
-done
+lemma rinit\<^sub>1_throw_PD:
+assumes eval: "P \<turnstile>\<^sub>1 \<langle>RI(C,e\<^sub>0);Cs \<leftarrow> unit,s\<rangle> \<Rightarrow> \<langle>throw a,s'\<rangle>"
+  and iconf: "iconf (shp\<^sub>1 s) (RI(C,e\<^sub>0);Cs \<leftarrow> unit)" and last: "last(C#Cs) = C'"
+shows "\<exists>sfs. shp\<^sub>1 s' C' = \<lfloor>(sfs,Error)\<rfloor>"
+proof(cases Cs)
+  case Nil
+  then show ?thesis using eval\<^sub>1_init_return[OF eval iconf] last by simp
+next
+  case (Cons a list)
+  then have nNil: "Cs \<noteq> []" by simp
+  then have "\<exists>Cs'. Cs = Cs' @ [C']" using last append_butlast_last_id[OF nNil]
+    by(rule_tac x="butlast Cs" in exI) simp
+  then show ?thesis using eval\<^sub>1_init_return[OF eval iconf] by simp
+qed
 
 subsubsection "The proof"
 
 lemma fixes P\<^sub>1 defines [simp]: "P \<equiv> compP\<^sub>2 P\<^sub>1"
 assumes wf: "wf_J\<^sub>1_prog P\<^sub>1"
 shows Jcc: "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>e,(h\<^sub>0,ls\<^sub>0,sh\<^sub>0)\<rangle> \<Rightarrow> \<langle>ef,(h\<^sub>1,ls\<^sub>1,sh\<^sub>1)\<rangle> \<Longrightarrow>
   (\<And>E C M pc ics v xa vs frs I.
      \<lbrakk> Jcc_cond P\<^sub>1 E C M vs pc ics I h\<^sub>0 sh\<^sub>0 e \<rbrakk> \<Longrightarrow>
      (ef = Val v \<longrightarrow>
          P \<turnstile> (None,h\<^sub>0,Jcc_frames P C M vs ls\<^sub>0 pc ics frs e,sh\<^sub>0)
                 -jvm\<rightarrow> Jcc_rhs P\<^sub>1 E C M vs ls\<^sub>0 pc ics frs h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v e)
      \<and>
      (ef = Throw xa \<longrightarrow> Jcc_err P C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 xa e)
   )"
 (*<*)
   (is "_ \<Longrightarrow> (\<And>E C M pc ics v xa vs frs I.
                   PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 ef h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics v xa vs frs I)")
 (*>*)
 and "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>es,(h\<^sub>0,ls\<^sub>0,sh\<^sub>0)\<rangle> [\<Rightarrow>] \<langle>fs,(h\<^sub>1,ls\<^sub>1,sh\<^sub>1)\<rangle> \<Longrightarrow>
     (\<And>C M pc ics ws xa es' vs frs I.
       \<lbrakk> P,C,M,pc \<rhd> compEs\<^sub>2 es; P,C,M \<rhd> compxEs\<^sub>2 es pc (size vs)/I,size vs;
        {pc..<pc+size(compEs\<^sub>2 es)} \<subseteq> I; ics = No_ics;
        \<not>sub_RIs es \<rbrakk> \<Longrightarrow>
       (fs = map Val ws \<longrightarrow>
        P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0) -jvm\<rightarrow>
              (None,h\<^sub>1,(rev ws @ vs,ls\<^sub>1,C,M,pc+size(compEs\<^sub>2 es),ics)#frs,sh\<^sub>1))
       \<and>
       (fs = map Val ws @ Throw xa # es' \<longrightarrow>
        (\<exists>pc\<^sub>1. pc \<le> pc\<^sub>1 \<and> pc\<^sub>1 < pc + size(compEs\<^sub>2 es) \<and>
                 \<not> caught P pc\<^sub>1 h\<^sub>1 xa (compxEs\<^sub>2 es pc (size vs)) \<and>
                 (\<exists>vs'. P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0)
                                      -jvm\<rightarrow> handle P C M xa h\<^sub>1 (vs'@vs) ls\<^sub>1 pc\<^sub>1 ics frs sh\<^sub>1))))"
 (*<*)
   (is "_ \<Longrightarrow> (\<And>C M pc ics ws xa es' vs frs I.
                   PROP ?Ps es h\<^sub>0 ls\<^sub>0 sh\<^sub>0 fs h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C M pc ics ws xa es' vs frs I)")
 proof (induct rule:eval\<^sub>1_evals\<^sub>1_inducts)
   case New\<^sub>1 thus ?case by auto
 next
   case (NewFail\<^sub>1 sh C' sfs h ls)
   let ?xa = "addr_of_sys_xcpt OutOfMemory"
   have "P \<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\<rightarrow> handle P C M ?xa h vs ls pc ics frs sh"
     using NewFail\<^sub>1 by(clarsimp simp: handle_def)
   then show ?case by(auto intro!: exI[where x="[]"])
 next
   case (NewInit\<^sub>1 sh C' h ls v' h' ls' sh' a FDTs h'')
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (new C')
     = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\<^sub>2 (new C')),ics)#frs,sh'), err)"
     using NewInit\<^sub>1.prems(1) by clarsimp
   have "Ex (WTrt2\<^sub>1 P\<^sub>1 E h sh (INIT C' ([C'],False) \<leftarrow> unit))"
     using has_fields_is_class[OF NewInit\<^sub>1.hyps(5)] by auto
   then obtain err' where pcs':
     "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v' xa (INIT C' ([C'],False) \<leftarrow> unit)
     = (True, (vs,ls,C,M,pc,Calling C' []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'), err')"
     using NewInit\<^sub>1.prems(1) by auto
   have IH: "PROP ?P (INIT C' ([C'],False) \<leftarrow> unit) h ls sh (Val v')
              h' ls' sh' E C M pc ics v' xa vs frs I" by fact
   have ls: "ls = ls'" by(rule init\<^sub>1_same_loc[OF NewInit\<^sub>1.hyps(2)])
   obtain sfs i where sh': "sh' C' = Some(sfs,i)"
     using init\<^sub>1_Val_PD[OF NewInit\<^sub>1.hyps(2)] by clarsimp
   have "P \<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling C' [])#frs,sh)"
   proof(cases "sh C'")
     case None then show ?thesis using NewInit\<^sub>1.prems by(cases ics) auto
   next
     case (Some a)
     then obtain sfs i where "a = (sfs,i)" by(cases a)
     then show ?thesis using NewInit\<^sub>1.hyps(1) NewInit\<^sub>1.prems Some
       by(cases ics; case_tac i) auto
   qed
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None, h', (vs, ls, C, M, pc, Called []) # frs, sh')"
     using IH pcs' by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None, h'', (Addr a#vs, ls, C, M, Suc pc, ics) # frs, sh')"
     using NewInit\<^sub>1.hyps(1,2,4-6) NewInit\<^sub>1.prems sh' by(cases ics) auto
   finally show ?case using pcs ls by clarsimp
 next
   case (NewInitOOM\<^sub>1 sh C' h ls v' h' ls' sh')
   let ?xa = "addr_of_sys_xcpt OutOfMemory"
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (new C')
     = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\<^sub>2 (new C')),ics)#frs,sh'), err)"
     using NewInitOOM\<^sub>1.prems(1) by clarsimp
   have "Ex (WTrt2\<^sub>1 P\<^sub>1 E h sh (INIT C' ([C'],False) \<leftarrow> unit))" using NewInitOOM\<^sub>1.hyps(5) by auto
   then obtain err' where pcs':
     "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v' xa (INIT C' ([C'],False) \<leftarrow> unit)
     = (True, (vs,ls,C,M,pc,Calling C' []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'), err')"
     using NewInitOOM\<^sub>1.prems(1) by auto
   have IH: "PROP ?P (INIT C' ([C'],False) \<leftarrow> unit) h ls sh (Val v')
              h' ls' sh' E C M pc ics v' xa vs frs I" by fact
   have ls: "ls = ls'" by(rule init\<^sub>1_same_loc[OF NewInitOOM\<^sub>1.hyps(2)])
   have "iconf (shp\<^sub>1 (h, ls, sh)) (INIT C' ([C'],False) \<leftarrow> unit)" by simp
   then obtain sfs i where sh': "sh' C' = Some(sfs,i)"
     using init\<^sub>1_Val_PD[OF NewInitOOM\<^sub>1.hyps(2)] by clarsimp
   have "P \<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling C' [])#frs,sh)"
   proof(cases "sh C'")
     case None then show ?thesis using NewInitOOM\<^sub>1.prems by(cases ics) auto
   next
     case (Some a)
     then obtain sfs i where "a = (sfs,i)" by(cases a)
     then show ?thesis using NewInitOOM\<^sub>1.hyps(1) NewInitOOM\<^sub>1.prems Some
       by(cases ics; case_tac i) auto
   qed
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None, h', (vs, ls, C, M, pc, Called []) # frs, sh')"
     using IH pcs' by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h' vs ls pc ics frs sh'"
     using NewInitOOM\<^sub>1.hyps(1,2,4,5) NewInitOOM\<^sub>1.prems sh' by(auto simp: handle_def)
   finally show ?case using pcs ls by(simp, metis (no_types) append_Nil le_refl lessI)
 next
   case (NewInitThrow\<^sub>1 sh C' h ls a h' ls' sh')
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (new C')
     = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\<^sub>2 (new C')),ics)#frs,sh'), err)"
     using NewInitThrow\<^sub>1.prems(1) by clarsimp
   obtain a' where throw: "throw a = Throw a'" using eval\<^sub>1_final[OF NewInitThrow\<^sub>1.hyps(2)] by clarsimp
   have "Ex (WTrt2\<^sub>1 P\<^sub>1 E h sh (INIT C' ([C'],False) \<leftarrow> unit))" using NewInitThrow\<^sub>1.hyps(4) by auto
   then obtain vs' where pcs':
     "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v a' (INIT C' ([C'],False) \<leftarrow> unit)
     = (True, (vs,ls,C,M,pc,Calling C' []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'),
         P \<turnstile> (None,h,(vs,ls,C,M,pc,Calling C' []) # frs,sh)
                -jvm\<rightarrow> handle P C M a' h' (vs'@vs) ls pc ics frs sh')"
     using NewInitThrow\<^sub>1.prems(1) by simp blast
   have IH: "PROP ?P (INIT C' ([C'],False) \<leftarrow> unit) h ls sh (throw a)
              h' ls' sh' E C M pc ics v a' vs frs I" by fact
   have ls: "ls = ls'" by(rule init\<^sub>1_same_loc[OF NewInitThrow\<^sub>1.hyps(2)])
   then have "P \<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling C' []) # frs,sh)"
   proof(cases "sh C'")
     case None then show ?thesis using NewInitThrow\<^sub>1.prems by(cases ics) auto
   next
     case (Some a)
     then obtain sfs i where "a = (sfs,i)" by(cases a)
     then show ?thesis using NewInitThrow\<^sub>1.hyps(1) NewInitThrow\<^sub>1.prems Some
       by(cases ics; case_tac i) auto
   qed
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M a' h' (vs'@vs) ls pc ics frs sh'" using IH pcs' throw by auto
   finally show ?case using throw ls by auto
 next
   case (Cast\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 D fs C')
   let ?pc = "pc + length(compE\<^sub>2 e)"
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (Cast C' e)
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (Cast C' e)),ics)#frs,sh\<^sub>1), err)"
     using Cast\<^sub>1.prems(1) by auto
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (addr a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Addr a) xa vs frs I" by fact
   then have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0) -jvm\<rightarrow>
              (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using Jcc_pieces_Cast[OF assms(1) pcs, of "Addr a"] Cast\<^sub>1.prems pcs by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc+1,ics)#frs,sh\<^sub>1)"
     using Cast\<^sub>1 by (auto simp add:cast_ok_def)
   finally show ?case by auto
 next
   case (CastNull\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C')
   let ?pc = "pc + length(compE\<^sub>2 e)"
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (Cast C' e)
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (Cast C' e)),ics)#frs,sh\<^sub>1), err)"
     using CastNull\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 null h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics Null xa vs frs I" by fact
   then have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0) -jvm\<rightarrow>
              (None,h\<^sub>1,(Null#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using Jcc_pieces_Cast[OF assms(1) pcs, of Null] CastNull\<^sub>1.prems pcs by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(Null#vs,ls\<^sub>1,C,M,?pc+1,ics)#frs,sh\<^sub>1)"
     using CastNull\<^sub>1 by (auto simp add:cast_ok_def)
   finally show ?case by auto
 next
   case (CastFail\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 D fs C')
   let ?pc = "pc + length(compE\<^sub>2 e)"
   let ?xa = "addr_of_sys_xcpt ClassCast"
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (Cast C' e)
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (Cast C' e)),ics)#frs,sh\<^sub>1), err)"
     using CastFail\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (addr a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Addr a) xa vs frs I" by fact
   then have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0) -jvm\<rightarrow>
              (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using Jcc_pieces_Cast[OF assms(1) pcs, of "Addr a"] CastFail\<^sub>1.prems pcs by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>1 (Addr a#vs) ls\<^sub>1 ?pc ics frs sh\<^sub>1"
     using CastFail\<^sub>1 by (auto simp add:handle_def cast_ok_def)
   finally have exec: "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0) -jvm\<rightarrow> \<dots>".
   show ?case (is "?N \<and> (?eq \<longrightarrow> ?err)")
   proof
     show ?N by simp
   next
     { assume ?eq
       then have ?err using exec by (auto intro!: exI[where x="?pc"] exI[where x="[Addr a]"])
     }
     thus "?eq \<longrightarrow> ?err" by simp
   qed
 next
   case (CastThrow\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 e' h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C')
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (Cast C' e)
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (Cast C' e)),ics)#frs,sh\<^sub>1), err)"
     using CastThrow\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (throw e') h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics v xa vs frs I" by fact
   show ?case using IH Jcc_pieces_Cast[OF assms(1) pcs, of v] CastThrow\<^sub>1.prems pcs less_SucI
    by(simp, blast)
 next
   case Val\<^sub>1 thus ?case by auto
 next
   case Var\<^sub>1 thus ?case by auto
 next
   case (BinOp\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 v\<^sub>1 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e\<^sub>2 v\<^sub>2 h\<^sub>2 ls\<^sub>2 sh\<^sub>2 bop w)
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2)
     = (True, frs', (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,pc+size(compE\<^sub>2 (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2)),ics)#frs,sh\<^sub>2), err)"
     using BinOp\<^sub>1.prems(1) by clarsimp
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compE\<^sub>2 e\<^sub>2)"
   have IH\<^sub>1: "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (Val v\<^sub>1) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics v\<^sub>1 xa vs frs
                      (I - pcs (compxE\<^sub>2 e\<^sub>2 (pc + length (compE\<^sub>2 e\<^sub>1)) (Suc (length vs))))" by fact
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (Val v\<^sub>2) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M ?pc\<^sub>1 ics v\<^sub>2 xa (v\<^sub>1#vs) frs
                      (I - pcs(compxE\<^sub>2 e\<^sub>1 pc (size vs)))" by fact
   have "P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> (None,h\<^sub>1,(v\<^sub>1#vs,ls\<^sub>1,C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
     using IH\<^sub>1 Jcc_pieces_BinOp1[OF pcs, of h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v\<^sub>1] by simp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(v\<^sub>2#v\<^sub>1#vs,ls\<^sub>2,C,M,?pc\<^sub>2,ics)#frs,sh\<^sub>2)"
     using IH\<^sub>2 Jcc_pieces_BinOp2[OF assms(1) pcs, of h\<^sub>1 v\<^sub>1 ls\<^sub>1 sh\<^sub>1 v\<^sub>2] by (simp add: add.assoc)
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(w#vs,ls\<^sub>2,C,M,?pc\<^sub>2+1,ics)#frs,sh\<^sub>2)"
     using BinOp\<^sub>1 by(cases bop) auto
   finally show ?case using pcs by (auto split: bop.splits simp:add.assoc)
 next
   case (BinOpThrow\<^sub>1\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 e h\<^sub>1 ls\<^sub>1 sh\<^sub>1 bop e\<^sub>2)
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2)
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2)),ics)#frs,sh\<^sub>1), err)"
     using BinOpThrow\<^sub>1\<^sub>1.prems(1) by clarsimp
   have IH\<^sub>1: "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (throw e) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics v xa vs frs
                      (I - pcs (compxE\<^sub>2 e\<^sub>2 (pc + length (compE\<^sub>2 e\<^sub>1)) (Suc (length vs))))" by fact
   show ?case using IH\<^sub>1 Jcc_pieces_BinOp1[OF pcs, of h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v] BinOpThrow\<^sub>1\<^sub>1.prems nsub_RI_Jcc_pieces
     by auto
 next
   case (BinOpThrow\<^sub>2\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 v\<^sub>1 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e\<^sub>2 e h\<^sub>2 ls\<^sub>2 sh\<^sub>2 bop)
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2)
     = (True, frs', (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,pc+size(compE\<^sub>2 (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2)),ics)#frs,sh\<^sub>2), err)"
     using BinOpThrow\<^sub>2\<^sub>1.prems(1) by clarsimp
   let ?pc = "pc + length(compE\<^sub>2 e\<^sub>1)"
   have IH\<^sub>1: "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (Val v\<^sub>1) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics v\<^sub>1 xa vs frs
                      (I - pcs (compxE\<^sub>2 e\<^sub>2 (pc + length (compE\<^sub>2 e\<^sub>1)) (Suc (length vs))))" by fact
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (throw e) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M ?pc ics v xa (v\<^sub>1#vs) frs
                      (I - pcs(compxE\<^sub>2 e\<^sub>1 pc (size vs)))" by fact
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(v\<^sub>1#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
   have 1: "P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> ?\<sigma>\<^sub>1"
     using IH\<^sub>1 Jcc_pieces_BinOp1[OF pcs, of h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v\<^sub>1] by simp
   have "(throw e = Val v \<longrightarrow>  P \<turnstile> (None, h\<^sub>0, Jcc_frames P C M vs ls\<^sub>0 pc ics frs (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2), sh\<^sub>0) -jvm\<rightarrow>
      Jcc_rhs P\<^sub>1 E C M vs ls\<^sub>0 pc ics frs h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2))
    \<and> (throw e = Throw xa \<longrightarrow> (\<exists>pc\<^sub>1. pc \<le> pc\<^sub>1 \<and> pc\<^sub>1 < pc + size(compE\<^sub>2 (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2)) \<and>
                \<not> caught P pc\<^sub>1 h\<^sub>2 xa (compxE\<^sub>2 (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2) pc (size vs)) \<and>
                (\<exists>vs'. P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> handle P C M xa h\<^sub>2 (vs'@vs) ls\<^sub>2 pc\<^sub>1 ics frs sh\<^sub>2)))"
    (is "?N \<and> (?eq \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2))")
   proof
     show ?N by simp
   next
     { assume ?eq
       then obtain pc\<^sub>2 vs' where
         pc\<^sub>2: "?pc \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc + size(compE\<^sub>2 e\<^sub>2) \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 e\<^sub>2 ?pc (size vs + 1))" and
         2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (vs'@v\<^sub>1#vs) ls\<^sub>2 pc\<^sub>2 ics frs sh\<^sub>2"
         using IH\<^sub>2 Jcc_pieces_BinOp2[OF assms(1) pcs, of h\<^sub>1 v\<^sub>1 ls\<^sub>1 sh\<^sub>1 v] BinOpThrow\<^sub>2\<^sub>1.prems by clarsimp
       then have "?H pc\<^sub>2" using jvm_trans[OF 1 2] by(auto intro!: exI[where x="vs'@[v\<^sub>1]"])
       hence "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     }
     thus "?eq \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)" by iprover
   qed
   then show ?case using pcs by simp blast
 next
   case (FAcc\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C' fs F T D w)
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (e\<bullet>F{D})
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (e\<bullet>F{D})),ics)#frs,sh\<^sub>1), err)"
     using FAcc\<^sub>1.prems(1) by clarsimp
   have "P\<^sub>1 \<turnstile> D sees F,NonStatic:T in D" by(rule has_field_sees[OF has_field_idemp[OF FAcc\<^sub>1.hyps(4)]])
   then have field: "field P D F = (D,NonStatic,T)" by simp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (addr a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Addr a) xa vs frs I" by fact
   let ?pc = "pc + length(compE\<^sub>2 e)"
   have "P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using IH Jcc_pieces_FAcc[OF pcs, of "Addr a"] pcs by simp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc+1,ics)#frs,sh\<^sub>1)"
     using FAcc\<^sub>1 field by auto
   finally have "P \<turnstile> (None, h\<^sub>0, frs', sh\<^sub>0) -jvm\<rightarrow> (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc+1,ics)#frs,sh\<^sub>1)"
     by auto
   then show ?case using pcs by auto
 next
   case (FAccNull\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 F D)
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (e\<bullet>F{D})
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (e\<bullet>F{D})),ics)#frs,sh\<^sub>1), err)"
     using FAccNull\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 null h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics Null xa vs frs I" by fact
   let ?pc = "pc + length(compE\<^sub>2 e)"
   let ?xa = "addr_of_sys_xcpt NullPointer"
   have "P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> (None,h\<^sub>1,(Null#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using IH Jcc_pieces_FAcc[OF pcs, of Null] by simp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>1 (Null#vs) ls\<^sub>1 ?pc ics frs sh\<^sub>1"
     using FAccNull\<^sub>1.prems
     by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)
   finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x="[Null]"])
 next
   case (FAccThrow\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 e' h\<^sub>1 ls\<^sub>1 sh\<^sub>1 F D)
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (e\<bullet>F{D})
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (e\<bullet>F{D})),ics)#frs,sh\<^sub>1), err)"
     using FAccThrow\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (throw e') h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics v xa vs frs I" by fact
   show ?case using IH Jcc_pieces_FAcc[OF pcs, of v] FAccThrow\<^sub>1.prems nsub_RI_Jcc_pieces
     less_Suc_eq by auto
 next
   case (FAccNone\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C fs F D)
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (e\<bullet>F{D})
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (e\<bullet>F{D})),ics)#frs,sh\<^sub>1), err)"
     using FAccNone\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (addr a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Addr a) xa vs frs I" by fact
   let ?pc = "pc + length(compE\<^sub>2 e)"
   let ?xa = "addr_of_sys_xcpt NoSuchFieldError"
   have "P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using IH Jcc_pieces_FAcc[OF pcs, of "Addr a"] by simp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>1 (Addr a#vs) ls\<^sub>1 ?pc ics frs sh\<^sub>1"
     using FAccNone\<^sub>1
     by(cases ics; clarsimp simp:split_beta handle_def simp del: split_paired_Ex)
   finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x="[Addr a]"])
 next
   case (FAccStatic\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C' fs F T D)
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (e\<bullet>F{D})
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (e\<bullet>F{D})),ics)#frs,sh\<^sub>1), err)"
     using FAccStatic\<^sub>1.prems(1) by clarsimp
   have "P\<^sub>1 \<turnstile> D sees F,Static:T in D" by(rule has_field_sees[OF has_field_idemp[OF FAccStatic\<^sub>1.hyps(4)]])
   then have field: "field P D F = (D,Static,T)" by simp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (addr a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Addr a) xa vs frs I" by fact
   let ?pc = "pc + length(compE\<^sub>2 e)"
   let ?xa = "addr_of_sys_xcpt IncompatibleClassChangeError"
   have "P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using IH Jcc_pieces_FAcc[OF pcs, of "Addr a"] by simp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>1 (Addr a#vs) ls\<^sub>1 ?pc ics frs sh\<^sub>1"
     using FAccStatic\<^sub>1 field by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)
   finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x="[Addr a]"])
 next
   case (SFAcc\<^sub>1 C' F t D sh sfs v' h ls)
   have has: "P\<^sub>1 \<turnstile> D has F,Static:t in D" by(rule has_field_idemp[OF SFAcc\<^sub>1.hyps(1)])
   have "P\<^sub>1 \<turnstile> D sees F,Static:t in D" by(rule has_field_sees[OF has])
   then have field: "field P D F = (D,Static,t)" by simp
   then have "P \<turnstile> (None,h,Jcc_frames P C M vs ls pc ics frs (C'\<bullet>\<^sub>sF{D}),sh) -jvm\<rightarrow>
              (None,h,(v'#vs,ls,C,M,Suc pc,ics)#frs,sh)"
     using SFAcc\<^sub>1 has by(cases ics) auto
   then show ?case by clarsimp
 next
   case (SFAccInit\<^sub>1 C' F t D sh h ls v' h' ls' sh' sfs i v'')
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (C'\<bullet>\<^sub>sF{D})
     = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\<^sub>2 (C'\<bullet>\<^sub>sF{D})),ics)#frs,sh'), err)"
     using SFAccInit\<^sub>1.prems(1) by clarsimp
   have "Ex (WTrt2\<^sub>1 P\<^sub>1 E h sh (INIT D ([D],False) \<leftarrow> unit))"
     using has_field_is_class'[OF SFAccInit\<^sub>1.hyps(1)] by auto
   then obtain err' where pcs':
     "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v' xa (INIT D ([D],False) \<leftarrow> unit)
     = (True, (vs,ls,C,M,pc,Calling D []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'), err')"
     using SFAccInit\<^sub>1.prems(1) by auto
   have IH: "PROP ?P (INIT D ([D],False) \<leftarrow> unit) h ls sh (Val v')
              h' ls' sh' E C M pc ics v' xa vs frs I" by fact
   have ls: "ls = ls'" by(rule init\<^sub>1_same_loc[OF SFAccInit\<^sub>1.hyps(3)])
   have has: "P\<^sub>1 \<turnstile> D has F,Static:t in D" by(rule has_field_idemp[OF SFAccInit\<^sub>1.hyps(1)])
   have "P\<^sub>1 \<turnstile> D sees F,Static:t in D" by(rule has_field_sees[OF has])
   then have field: "field P D F = (D,Static,t)" by simp
   have "P \<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling D [])#frs,sh)"
   proof(cases "sh D")
     case None then show ?thesis using SFAccInit\<^sub>1.hyps(1,2,5,6) SFAccInit\<^sub>1.prems field
       by(cases ics) auto
   next
     case (Some a)
     then obtain sfs i where "a = (sfs,i)" by(cases a)
     then show ?thesis using SFAccInit\<^sub>1.hyps(1,2,5,6) SFAccInit\<^sub>1.prems field Some
       by(cases ics; case_tac i) auto
   qed
   also have "P \<turnstile> ... -jvm\<rightarrow> (None, h', (vs, ls, C, M, pc, Called []) # frs, sh')"
     using IH pcs' by auto
   also have "P \<turnstile> ... -jvm\<rightarrow> (None, h', (v''#vs, ls, C, M, Suc pc, ics) # frs, sh')"
     using SFAccInit\<^sub>1.hyps(1,2,5,6) SFAccInit\<^sub>1.prems has field by(cases ics) auto
   finally show ?case using pcs ls by clarsimp
 next
   case (SFAccInitThrow\<^sub>1 C' F t D sh h ls a h' ls' sh')
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (C'\<bullet>\<^sub>sF{D})
     = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\<^sub>2 (C'\<bullet>\<^sub>sF{D})),ics)#frs,sh'), err)"
     using SFAccInitThrow\<^sub>1.prems(1) by clarsimp
   obtain a' where throw: "throw a = Throw a'" using eval\<^sub>1_final[OF SFAccInitThrow\<^sub>1.hyps(3)] by clarsimp
   have "Ex (WTrt2\<^sub>1 P\<^sub>1 E h sh (INIT D ([D],False) \<leftarrow> unit))"
     using has_field_is_class'[OF SFAccInitThrow\<^sub>1.hyps(1)] by auto
   then obtain vs' where pcs':
     "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v a' (INIT D ([D],False) \<leftarrow> unit)
     = (True, (vs,ls,C,M,pc,Calling D []) # frs, (None,h',(vs,ls,C,M,pc,Called [])#frs,sh'),
         P \<turnstile> (None,h,(vs,ls,C,M,pc,Calling D []) # frs,sh)
                -jvm\<rightarrow> handle P C M a' h' (vs'@vs) ls pc ics frs sh')"
     using SFAccInitThrow\<^sub>1.prems(1) by simp blast
   have IH: "PROP ?P (INIT D ([D],False) \<leftarrow> unit) h ls sh (throw a)
              h' ls' sh' E C M pc ics v a' vs frs I" by fact
   have ls: "ls = ls'" by(rule init\<^sub>1_same_loc[OF SFAccInitThrow\<^sub>1.hyps(3)])
   have has: "P\<^sub>1 \<turnstile> D has F,Static:t in D" by(rule has_field_idemp[OF SFAccInitThrow\<^sub>1.hyps(1)])
   have "P\<^sub>1 \<turnstile> D sees F,Static:t in D" by(rule has_field_sees[OF has])
   then have field: "field P D F = (D,Static,t)" by simp
   then have "P \<turnstile> (None,h,(vs,ls,C,M,pc,ics)#frs,sh) -jvm\<rightarrow> (None,h,(vs,ls,C,M,pc,Calling D []) # frs,sh)"
   proof(cases "sh D")
     case None then show ?thesis using SFAccInitThrow\<^sub>1.hyps(1,2) SFAccInitThrow\<^sub>1.prems field
       by(cases ics) auto
   next
     case (Some a)
     then obtain sfs i where "a = (sfs,i)" by(cases a)
     then show ?thesis using SFAccInitThrow\<^sub>1.hyps(1,2) SFAccInitThrow\<^sub>1.prems field Some
       by(cases ics; case_tac i) auto
   qed
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M a' h' (vs'@vs) ls pc ics frs sh'"
     using IH pcs' throw by auto
   finally show ?case using throw ls by auto
 next
   case (SFAccNone\<^sub>1 C' F D h\<^sub>1 ls\<^sub>1 sh\<^sub>1)
   then obtain frs' err where pcs:
    "Jcc_pieces P\<^sub>1 E C M h\<^sub>1 vs ls\<^sub>1 pc ics frs sh\<^sub>1 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (C'\<bullet>\<^sub>sF{D})
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (C'\<bullet>\<^sub>sF{D})),ics)#frs,sh\<^sub>1), err)"
     by clarsimp
   let ?xa = "addr_of_sys_xcpt NoSuchFieldError"
   have "P \<turnstile> (None,h\<^sub>1,frs',sh\<^sub>1) -jvm\<rightarrow> handle P C M ?xa h\<^sub>1 vs ls\<^sub>1 pc ics frs sh\<^sub>1"
     using SFAccNone\<^sub>1 pcs
     by(cases ics; clarsimp simp:split_beta handle_def simp del: split_paired_Ex)
   then show ?case using pcs by(auto intro!: exI[where x = pc] exI[where x="[]"])
 next
   case (SFAccNonStatic\<^sub>1 C' F t D h\<^sub>1 ls\<^sub>1 sh\<^sub>1)
   let ?frs' = "(vs, ls\<^sub>1, C, M, pc, ics) # frs"
   let ?xa = "addr_of_sys_xcpt IncompatibleClassChangeError"
   have "P\<^sub>1 \<turnstile> D sees F,NonStatic:t in D"
     by(rule has_field_sees[OF has_field_idemp[OF SFAccNonStatic\<^sub>1.hyps(1)]])
   then have field: "field P D F = (D,NonStatic,t)" by simp
   have "P \<turnstile> (None,h\<^sub>1,?frs',sh\<^sub>1) -jvm\<rightarrow> handle P C M ?xa h\<^sub>1 vs ls\<^sub>1 pc ics frs sh\<^sub>1"
     using SFAccNonStatic\<^sub>1
     proof(cases ics)
       case No_ics
       then show ?thesis using SFAccNonStatic\<^sub>1 field
        by (auto simp:split_beta handle_def simp del: split_paired_Ex)
     qed(simp_all)
   then show ?case by (auto intro!: exI[where x = pc] exI[where x="[]"])
 next
   case (LAss\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 w h\<^sub>1 ls\<^sub>1 sh\<^sub>1 i ls\<^sub>2)
   let ?pc = "pc + length(compE\<^sub>2 e)"
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (i:=e)
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (i:=e)),ics)#frs,sh\<^sub>1), err)"
     using LAss\<^sub>1.prems(1) by auto
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (Val w) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics w xa vs frs I" by fact
   then have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0) -jvm\<rightarrow>
              (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using Jcc_pieces_LAss[OF assms(1) pcs, of w] LAss\<^sub>1.prems pcs by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(Unit#vs,ls\<^sub>2,C,M,?pc+2,ics)#frs,sh\<^sub>1)"
     using LAss\<^sub>1 by (auto simp add:cast_ok_def)
   finally show ?case by auto
 next
   case (LAssThrow\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 w h\<^sub>1 ls\<^sub>1 sh\<^sub>1 i)
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (i:=e)
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (i:=e)),ics)#frs,sh\<^sub>1), err)"
     using LAssThrow\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (throw w) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics v xa vs frs I" by fact
   show ?case using IH Jcc_pieces_LAss[OF assms(1) pcs, of v] LAssThrow\<^sub>1.prems pcs less_SucI
     by(simp, blast)
 next
   case (FAss\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e\<^sub>2 w h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C' fs F T D fs' h\<^sub>2')
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e\<^sub>1\<bullet>F{D} := e\<^sub>2)
     = (True, frs', (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,pc+size(compE\<^sub>2 (e\<^sub>1\<bullet>F{D} := e\<^sub>2)),ics)#frs,sh\<^sub>2), err)"
     using FAss\<^sub>1.prems(1) by clarsimp
   have "P\<^sub>1 \<turnstile> D sees F,NonStatic:T in D" by(rule has_field_sees[OF has_field_idemp[OF FAss\<^sub>1.hyps(6)]])
   then have field: "field P D F = (D,NonStatic,T)" by simp
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compE\<^sub>2 e\<^sub>2)"
   have IH\<^sub>1: "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (addr a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Addr a) xa vs frs
                      (I - pcs (compxE\<^sub>2 e\<^sub>2 (pc + length (compE\<^sub>2 e\<^sub>1)) (Suc (length vs))))" by fact
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (Val w) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M ?pc\<^sub>1 ics w xa (Addr a#vs) frs
                      (I - pcs(compxE\<^sub>2 e\<^sub>1 pc (size vs)))" by fact
   have "P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
     using IH\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\<^sub>1 ls\<^sub>1 sh\<^sub>1 "Addr a"] by simp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(w#Addr a#vs,ls\<^sub>2,C,M,?pc\<^sub>2,ics)#frs,sh\<^sub>2)"
     using IH\<^sub>2 Jcc_pieces_FAss2[OF pcs, of h\<^sub>1 "Addr a" ls\<^sub>1 sh\<^sub>1 w] by (simp add: add.assoc)
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2',(Unit#vs,ls\<^sub>2,C,M,?pc\<^sub>2+2,ics)#frs,sh\<^sub>2)"
     using FAss\<^sub>1 field by auto
   finally show ?case using pcs by (auto simp:add.assoc)
 next
   case (FAssNull\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e\<^sub>2 w h\<^sub>2 ls\<^sub>2 sh\<^sub>2 F D)
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e\<^sub>1\<bullet>F{D} := e\<^sub>2)
     = (True, frs', (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,pc+size(compE\<^sub>2 (e\<^sub>1\<bullet>F{D} := e\<^sub>2)),ics)#frs,sh\<^sub>2), err)"
     using FAssNull\<^sub>1.prems(1) by clarsimp
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compE\<^sub>2 e\<^sub>2)"
   let ?xa = "addr_of_sys_xcpt NullPointer"
   have IH\<^sub>1: "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 null h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics Null xa vs frs
                      (I - pcs (compxE\<^sub>2 e\<^sub>2 (pc + length (compE\<^sub>2 e\<^sub>1)) (Suc (length vs))))" by fact
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (Val w) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M ?pc\<^sub>1 ics w xa (Null#vs) frs
                      (I - pcs(compxE\<^sub>2 e\<^sub>1 pc (size vs)))" by fact
   have "P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> (None,h\<^sub>1,(Null#vs,ls\<^sub>1,C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
     using IH\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\<^sub>1 ls\<^sub>1 sh\<^sub>1 Null] by simp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(w#Null#vs,ls\<^sub>2,C,M,?pc\<^sub>2,ics)#frs,sh\<^sub>2)"
     using IH\<^sub>2 Jcc_pieces_FAss2[OF pcs, of h\<^sub>1 Null ls\<^sub>1 sh\<^sub>1 w] by (simp add: add.assoc)
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>2 (w#Null#vs) ls\<^sub>2 ?pc\<^sub>2 ics frs sh\<^sub>2"
     using FAssNull\<^sub>1 by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)
   finally show ?case using pcs by (auto intro!: exI[where x = ?pc\<^sub>2] exI[where x="w#[Null]"])
 next
   case (FAssThrow\<^sub>2\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 w h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e\<^sub>2 e' h\<^sub>2 ls\<^sub>2 sh\<^sub>2 F D)
   let ?frs' = "(vs, ls\<^sub>0, C, M, pc, ics) # frs"
   obtain err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e\<^sub>1\<bullet>F{D} := e\<^sub>2)
     = (True, ?frs', (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,pc+size(compE\<^sub>2 (e\<^sub>1\<bullet>F{D} := e\<^sub>2)),ics)#frs,sh\<^sub>2), err)"
     using FAssThrow\<^sub>2\<^sub>1.prems(1) by clarsimp
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
   have IH\<^sub>1: "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (Val w) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics w xa vs frs
                      (I - pcs (compxE\<^sub>2 e\<^sub>2 (pc + length (compE\<^sub>2 e\<^sub>1)) (Suc (length vs))))" by fact
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (throw e') h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M ?pc\<^sub>1 ics v xa (w#vs) frs
                      (I - pcs(compxE\<^sub>2 e\<^sub>1 pc (size vs)))" by fact
   have 1: "P \<turnstile> (None,h\<^sub>0,?frs',sh\<^sub>0) -jvm\<rightarrow> ?\<sigma>\<^sub>1"
     using IH\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\<^sub>1 ls\<^sub>1 sh\<^sub>1 w] by simp
   show ?case (is "?N \<and> (?eq \<longrightarrow> ?err)")
   proof
     show ?N by simp
   next
     { assume ?eq
       moreover
       have "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (throw e') h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M ?pc\<^sub>1 ics v xa (w#vs) frs
                     (I - pcs (compxE\<^sub>2 e\<^sub>1 pc (length vs)))" by fact
       ultimately obtain pc\<^sub>2 vs' where
         pc\<^sub>2: "?pc\<^sub>1 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>1 + size(compE\<^sub>2 e\<^sub>2) \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 e\<^sub>2 ?pc\<^sub>1 (size vs + 1))" and
         2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (vs'@w#vs) ls\<^sub>2 pc\<^sub>2 ics frs sh\<^sub>2"
         using FAssThrow\<^sub>2\<^sub>1.prems Jcc_pieces_FAss2[OF pcs, of h\<^sub>1 w ls\<^sub>1 sh\<^sub>1] by auto
       have ?err using Jcc_pieces_FAss2[OF pcs, of h\<^sub>1 w ls\<^sub>1 sh\<^sub>1] pc\<^sub>2 jvm_trans[OF 1 2]
         by(auto intro!: exI[where x=pc\<^sub>2] exI[where x="vs'@[w]"])
     }
     thus "?eq \<longrightarrow> ?err" by simp
   qed
 next
   case (FAssThrow\<^sub>1\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 e' h\<^sub>1 ls\<^sub>1 sh\<^sub>1 F D e\<^sub>2)
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (e\<^sub>1\<bullet>F{D} := e\<^sub>2)
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (e\<^sub>1\<bullet>F{D} := e\<^sub>2)),ics)#frs,sh\<^sub>1), err)"
     using FAssThrow\<^sub>1\<^sub>1.prems(1) by clarsimp
   have IH\<^sub>1: "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (throw e') h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics v xa vs frs
                      (I - pcs (compxE\<^sub>2 e\<^sub>2 (pc + length (compE\<^sub>2 e\<^sub>1)) (Suc (length vs))))" by fact
   show ?case using IH\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v] FAssThrow\<^sub>1\<^sub>1.prems nsub_RI_Jcc_pieces
     by auto
 next
   case (FAssNone\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e\<^sub>2 w h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C' fs F D)
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e\<^sub>1\<bullet>F{D} := e\<^sub>2)
     = (True, frs', (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,pc+size(compE\<^sub>2 (e\<^sub>1\<bullet>F{D} := e\<^sub>2)),ics)#frs,sh\<^sub>2), err)"
     using FAssNone\<^sub>1.prems(1) by clarsimp
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compE\<^sub>2 e\<^sub>2)"
   let ?xa = "addr_of_sys_xcpt NoSuchFieldError"
   have IH\<^sub>1: "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (addr a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Addr a) xa vs frs
                      (I - pcs (compxE\<^sub>2 e\<^sub>2 (pc + length (compE\<^sub>2 e\<^sub>1)) (Suc (length vs))))" by fact
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (Val w) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M ?pc\<^sub>1 ics w xa (Addr a#vs) frs
                      (I - pcs(compxE\<^sub>2 e\<^sub>1 pc (size vs)))" by fact
   have "P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
     using IH\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\<^sub>1 ls\<^sub>1 sh\<^sub>1 "Addr a"] by simp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(w#Addr a#vs,ls\<^sub>2,C,M,?pc\<^sub>2,ics)#frs,sh\<^sub>2)"
     using IH\<^sub>2 Jcc_pieces_FAss2[OF pcs, of h\<^sub>1 "Addr a" ls\<^sub>1 sh\<^sub>1 w] by (simp add: add.assoc)
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>2 (w#Addr a#vs) ls\<^sub>2 ?pc\<^sub>2 ics frs sh\<^sub>2"
     using FAssNone\<^sub>1 by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)
   finally show ?case using pcs by (auto intro!: exI[where x = ?pc\<^sub>2] exI[where x="w#[Addr a]"])
 next
   case (FAssStatic\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e\<^sub>2 w h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C' fs F T D)
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e\<^sub>1\<bullet>F{D} := e\<^sub>2)
     = (True, frs', (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,pc+size(compE\<^sub>2 (e\<^sub>1\<bullet>F{D} := e\<^sub>2)),ics)#frs,sh\<^sub>2), err)"
     using FAssStatic\<^sub>1.prems(1) by clarsimp
   have "P\<^sub>1 \<turnstile> D sees F,Static:T in D" by(rule has_field_sees[OF has_field_idemp[OF FAssStatic\<^sub>1.hyps(6)]])
   then have field: "field P D F = (D,Static,T)" by simp
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compE\<^sub>2 e\<^sub>2)"
   let ?xa = "addr_of_sys_xcpt IncompatibleClassChangeError"
   have IH\<^sub>1: "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (addr a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Addr a) xa vs frs
                      (I - pcs (compxE\<^sub>2 e\<^sub>2 (pc + length (compE\<^sub>2 e\<^sub>1)) (Suc (length vs))))" by fact
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (Val w) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M ?pc\<^sub>1 ics w xa (Addr a#vs) frs
                      (I - pcs(compxE\<^sub>2 e\<^sub>1 pc (size vs)))" by fact
   have "P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> (None,h\<^sub>1,(Addr a#vs,ls\<^sub>1,C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
     using IH\<^sub>1 Jcc_pieces_FAss1[OF pcs, of h\<^sub>1 ls\<^sub>1 sh\<^sub>1 "Addr a"] by simp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(w#Addr a#vs,ls\<^sub>2,C,M,?pc\<^sub>2,ics)#frs,sh\<^sub>2)"
     using IH\<^sub>2 Jcc_pieces_FAss2[OF pcs, of h\<^sub>1 "Addr a" ls\<^sub>1 sh\<^sub>1 w] by (simp add: add.assoc)
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>2 (w#Addr a#vs) ls\<^sub>2 ?pc\<^sub>2 ics frs sh\<^sub>2"
     using FAssStatic\<^sub>1 field by(fastforce simp:split_beta handle_def simp del: split_paired_Ex)
   finally show ?case using pcs by (auto intro!: exI[where x = ?pc\<^sub>2] exI[where x="w#[Addr a]"])
 next
   case (SFAss\<^sub>1 e\<^sub>2 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 w h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C' F T D sfs sfs' sh\<^sub>1')
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (C'\<bullet>\<^sub>sF{D} := e\<^sub>2)
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (C'\<bullet>\<^sub>sF{D} := e\<^sub>2)),ics)#frs,sh\<^sub>1), err)"
     using SFAss\<^sub>1.prems(1) by clarsimp
   have "P\<^sub>1 \<turnstile> D sees F,Static:T in D" by(rule has_field_sees[OF has_field_idemp[OF SFAss\<^sub>1.hyps(3)]])
   then have field: "field P D F = (D,Static,T)" by simp
   have IH: "PROP ?P e\<^sub>2 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (Val w) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics w xa vs frs I" by fact
   let ?pc = "pc + length(compE\<^sub>2 e\<^sub>2)"
   have "P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using IH Jcc_pieces_SFAss[OF pcs, where v'=w] pcs by simp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(vs,ls\<^sub>1,C,M,?pc+1,ics)#frs,sh\<^sub>1')"
     using SFAss\<^sub>1.hyps(3-6) SFAss\<^sub>1.prems(1) field by auto
   also have "P \<turnstile> ... -jvm\<rightarrow> (None,h\<^sub>1,(Unit#vs,ls\<^sub>1,C,M,?pc+2,ics)#frs,sh\<^sub>1')"
     using SFAss\<^sub>1 by auto
   finally show ?case using pcs by auto
 next
   case (SFAssInit\<^sub>1 e\<^sub>2 h ls sh w h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C' F t D v' h' ls' sh' sfs i sfs' sh'')
   let ?pc = "pc + length(compE\<^sub>2 e\<^sub>2)"
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh'' v xa (C'\<bullet>\<^sub>sF{D}:=e\<^sub>2)
     = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\<^sub>2 (C'\<bullet>\<^sub>sF{D}:=e\<^sub>2)),ics)#frs,sh''), err)"
     using SFAssInit\<^sub>1.prems(1) by clarsimp
   have "Ex (WTrt2\<^sub>1 P\<^sub>1 E h\<^sub>1 sh\<^sub>1 (INIT D ([D],False) \<leftarrow> unit))"
     using has_field_is_class'[OF SFAssInit\<^sub>1.hyps(3)] by auto
   then obtain err' where pcs':
     "Jcc_pieces P\<^sub>1 E C M h\<^sub>1 (w#vs) ls\<^sub>1 ?pc ics frs sh\<^sub>1 I h' ls' sh' v' xa (INIT D ([D],False) \<leftarrow> unit)
     = (True, (w#vs,ls\<^sub>1,C,M,?pc,Calling D []) # frs,
        (None,h',(w#vs,ls\<^sub>1,C,M,?pc,Called [])#frs,sh'), err')"
     using SFAssInit\<^sub>1.prems(1) by simp
   have ls: "ls\<^sub>1 = ls'" by(rule init\<^sub>1_same_loc[OF SFAssInit\<^sub>1.hyps(5)])
   have has: "P\<^sub>1 \<turnstile> D has F,Static:t in D" by(rule has_field_idemp[OF SFAssInit\<^sub>1.hyps(3)])
   have "P\<^sub>1 \<turnstile> D sees F,Static:t in D" by(rule has_field_sees[OF has])
   then have field: "field P D F = (D,Static,t)" by simp
   have IH: "PROP ?P e\<^sub>2 h ls sh (Val w) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics w xa vs frs I" by fact
   have IHI: "PROP ?P (INIT D ([D],False) \<leftarrow> unit) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (Val v')
              h' ls' sh' E C M ?pc ics v' xa (w#vs) frs I" by fact
   have "P \<turnstile> (None,h,frs',sh) -jvm\<rightarrow> (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using IH Jcc_pieces_SFAss[OF pcs, where v'=w] by simp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc,Calling D [])#frs,sh\<^sub>1)"
   proof(cases "sh\<^sub>1 D")
     case None then show ?thesis using None SFAssInit\<^sub>1.hyps(1,3-5,7-9) SFAssInit\<^sub>1.prems field
       by(cases ics, auto)
   next
     case (Some a)
     then obtain sfs i where "a = (sfs,i)" by(cases a)
     then show ?thesis using SFAssInit\<^sub>1.hyps(1,3-5,7-9) SFAssInit\<^sub>1.prems field Some
       by(cases ics; case_tac i) auto
   qed
   also have "P \<turnstile> ... -jvm\<rightarrow> (None, h', (w#vs, ls\<^sub>1, C, M, ?pc, Called []) # frs, sh')"
     using IHI pcs' by clarsimp
   also have "P \<turnstile> ... -jvm\<rightarrow> (None, h', (vs, ls\<^sub>1, C, M, ?pc + 1, ics) # frs, sh'')"
     using SFAssInit\<^sub>1.hyps(1,3-5,7-9) SFAssInit\<^sub>1.prems has field by(cases ics) auto
   also have "P \<turnstile> ... -jvm\<rightarrow> (None, h', (Unit#vs, ls\<^sub>1, C, M, ?pc + 2, ics) # frs, sh'')"
     using SFAssInit\<^sub>1.hyps(1,3-5,7-9) SFAssInit\<^sub>1.prems has field by(cases ics) auto
   finally show ?case using pcs ls by simp blast
 next
   case (SFAssInitThrow\<^sub>1 e\<^sub>2 h ls sh w h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C' F t D a h' ls' sh')
   let ?pc = "pc + length(compE\<^sub>2 e\<^sub>2)"
   obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (C'\<bullet>\<^sub>sF{D}:=e\<^sub>2)
     = (True, frs', (None,h',(v#vs,ls',C,M,pc+size(compE\<^sub>2 (C'\<bullet>\<^sub>sF{D}:=e\<^sub>2)),ics)#frs,sh'), err)"
     using SFAssInitThrow\<^sub>1.prems(1) by clarsimp
   obtain a' where throw: "throw a = Throw a'" using eval\<^sub>1_final[OF SFAssInitThrow\<^sub>1.hyps(5)] by clarsimp
   have "Ex (WTrt2\<^sub>1 P\<^sub>1 E h\<^sub>1 sh\<^sub>1 (INIT D ([D],False) \<leftarrow> unit))"
     using has_field_is_class'[OF SFAssInitThrow\<^sub>1.hyps(3)] by auto
   then obtain vs' where pcs':
     "Jcc_pieces P\<^sub>1 E C M h\<^sub>1 (w#vs) ls\<^sub>1 ?pc ics frs sh\<^sub>1 I h' ls' sh' v a' (INIT D ([D],False) \<leftarrow> unit)
     = (True, (w#vs,ls\<^sub>1,C,M,?pc,Calling D []) # frs, (None,h',(w#vs,ls\<^sub>1,C,M,?pc,Called [])#frs,sh'),
          P \<turnstile> (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc,Calling D []) # frs,sh\<^sub>1)
                -jvm\<rightarrow> handle P C M a' h' (vs'@w#vs) ls\<^sub>1 ?pc ics frs sh')"
     using SFAssInitThrow\<^sub>1.prems(1) by simp blast
   have ls: "ls\<^sub>1 = ls'" by(rule init\<^sub>1_same_loc[OF SFAssInitThrow\<^sub>1.hyps(5)])
   have has: "P\<^sub>1 \<turnstile> D has F,Static:t in D" by(rule has_field_idemp[OF SFAssInitThrow\<^sub>1.hyps(3)])
   have "P\<^sub>1 \<turnstile> D sees F,Static:t in D" by(rule has_field_sees[OF has])
   then have field: "field P D F = (D,Static,t)" by simp
   have IH: "PROP ?P e\<^sub>2 h ls sh (Val w) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics w xa vs frs I" by fact
   have IHI: "PROP ?P (INIT D ([D],False) \<leftarrow> unit) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (throw a)
              h' ls' sh' E C M ?pc ics v a' (w#vs) frs I" by fact
   have "P \<turnstile> (None,h,(vs, ls, C, M, pc, ics) # frs,sh) -jvm\<rightarrow> (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using IH Jcc_pieces_SFAss[OF pcs, where v'=w] pcs by simp blast
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc,Calling D [])#frs,sh\<^sub>1)"
   proof(cases "sh\<^sub>1 D")
     case None then show ?thesis using SFAssInitThrow\<^sub>1.hyps(1,3,4,5) SFAssInitThrow\<^sub>1.prems field
       by(cases ics) auto
   next
     case (Some a)
     then obtain sfs i where "a = (sfs,i)" by(cases a)
     then show ?thesis using SFAssInitThrow\<^sub>1.hyps(1,3,4,5) SFAssInitThrow\<^sub>1.prems field Some
       by(cases ics; case_tac i) auto
   qed
   also have "P \<turnstile> ... -jvm\<rightarrow> handle P C M a' h' (vs'@w#vs) ls\<^sub>1 ?pc ics frs sh'"
     using IHI pcs' throw by auto
   finally show ?case using throw ls by(auto intro!: exI[where x = ?pc] exI[where x="vs'@[w]"])
 next
   case (SFAssThrow\<^sub>1 e\<^sub>2 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 e' h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C' F D)
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (C'\<bullet>\<^sub>sF{D} := e\<^sub>2)
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (C'\<bullet>\<^sub>sF{D} := e\<^sub>2)),ics)#frs,sh\<^sub>1), err)"
     using SFAssThrow\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e\<^sub>2 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (throw e') h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics v xa vs frs I" by fact
   show ?case using IH Jcc_pieces_SFAss[OF pcs, where v'=v] SFAssThrow\<^sub>1.prems nsub_RI_Jcc_pieces
     less_Suc_eq by auto
 next
   case (SFAssNone\<^sub>1 e\<^sub>2 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 w h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C' F D)
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (C'\<bullet>\<^sub>sF{D} := e\<^sub>2)
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (C'\<bullet>\<^sub>sF{D} := e\<^sub>2)),ics)#frs,sh\<^sub>1), err)"
     using SFAssNone\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e\<^sub>2 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (Val w) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics w xa vs frs I" by fact
   let ?pc = "pc + length(compE\<^sub>2 e\<^sub>2)"
   let ?xa = "addr_of_sys_xcpt NoSuchFieldError"
   have "P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using IH Jcc_pieces_SFAss[OF pcs, where v'=w] pcs by simp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>1 (w#vs) ls\<^sub>1 ?pc ics frs sh\<^sub>1"
     using SFAssNone\<^sub>1 by(cases ics; clarsimp simp add: handle_def)
   finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x="[w]"])
 next
   case (SFAssNonStatic\<^sub>1 e\<^sub>2 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 w h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C' F T D)
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>1 ls\<^sub>1 sh\<^sub>1 v xa (C'\<bullet>\<^sub>sF{D} := e\<^sub>2)
     = (True, frs', (None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,pc+size(compE\<^sub>2 (C'\<bullet>\<^sub>sF{D} := e\<^sub>2)),ics)#frs,sh\<^sub>1), err)"
     using SFAssNonStatic\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e\<^sub>2 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (Val w) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics w xa vs frs I" by fact
   let ?pc = "pc + length(compE\<^sub>2 e\<^sub>2)"
   let ?xa = "addr_of_sys_xcpt IncompatibleClassChangeError"
   have "P\<^sub>1 \<turnstile> D sees F,NonStatic:T in D"
     by(rule has_field_sees[OF has_field_idemp[OF SFAssNonStatic\<^sub>1.hyps(3)]])
   then have field: "field P D F = (D,NonStatic,T)" by simp
   have "P \<turnstile> (None,h\<^sub>0,frs',sh\<^sub>0) -jvm\<rightarrow> (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using IH Jcc_pieces_SFAss[OF pcs, where v'=w] pcs by simp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>1 (w#vs) ls\<^sub>1 ?pc ics frs sh\<^sub>1"
     using SFAssNonStatic\<^sub>1
     proof(cases ics)
       case No_ics
       then show ?thesis using SFAssNonStatic\<^sub>1 field
        by (auto simp:split_beta handle_def simp del: split_paired_Ex)
     qed(simp_all)
   finally show ?case using pcs by (auto intro!: exI[where x = ?pc] exI[where x="[w]"])
 next
   case (Call\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 es pvs h\<^sub>2 ls\<^sub>2 sh\<^sub>2 Ca fs M' Ts T body D ls\<^sub>2' f h\<^sub>3 ls\<^sub>3 sh\<^sub>3)
   let ?frs\<^sub>0 = "(vs, ls\<^sub>0, C,M,pc,ics)#frs"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,?frs\<^sub>0,sh\<^sub>0)"
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(Addr a#vs, ls\<^sub>1, C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compEs\<^sub>2 es)"
   let ?frs\<^sub>2 = "(rev pvs @ Addr a # vs, ls\<^sub>2, C,M,?pc\<^sub>2,ics)#frs"
   let ?\<sigma>\<^sub>2 = "(None,h\<^sub>2,?frs\<^sub>2,sh\<^sub>2)"
   let ?frs\<^sub>2' = "([], ls\<^sub>2', D,M',0,No_ics) # ?frs\<^sub>2"
   let ?\<sigma>\<^sub>2' = "(None, h\<^sub>2, ?frs\<^sub>2', sh\<^sub>2)"
   have nclinit: "M' \<noteq> clinit" using wf_sees_clinit1[OF wf] visible_method_exists[OF Call\<^sub>1.hyps(6)]
     sees_method_idemp[OF Call\<^sub>1.hyps(6)] by fastforce
   have "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>es,(h\<^sub>1, ls\<^sub>1, sh\<^sub>1)\<rangle> [\<Rightarrow>] \<langle>map Val pvs,(h\<^sub>2, ls\<^sub>2, sh\<^sub>2)\<rangle>" by fact
   hence [simp]: "length es = length pvs" by(auto dest:evals\<^sub>1_preserves_elen)
   have invoke: "P,C,M,?pc\<^sub>2 \<triangleright> Invoke M' (length Ts)"
     using Call\<^sub>1.hyps(7) Call\<^sub>1.prems(1) by clarsimp
   have nsub: "\<not> sub_RI body" by(rule sees_wf\<^sub>1_nsub_RI[OF wf Call\<^sub>1.hyps(6)])
   obtain err where pcs:
     "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>3 ls\<^sub>2 sh\<^sub>3 v xa (e\<bullet>M'(es)) =
     (True, ?frs\<^sub>0, (None, h\<^sub>3, (v#vs, ls\<^sub>2, C,M,?pc\<^sub>2+1,ics)#frs,sh\<^sub>3), err)"
    using Call\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (addr a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Addr a) xa vs frs
     (I - pcs (compxEs\<^sub>2 es (pc + length (compE\<^sub>2 e)) (Suc (length vs))))" by fact
   have IH_es: "PROP ?Ps es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (map Val pvs) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C M ?pc\<^sub>1 ics pvs xa
                     (map Val pvs) (Addr a#vs) frs (I - pcs(compxE\<^sub>2 e pc (size vs)))" by fact
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1" using Jcc_pieces_Call1[OF pcs] IH by clarsimp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>2" using IH_es Call\<^sub>1.prems by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>2'"
     using jvm_Invoke[OF assms(1) invoke _ Call\<^sub>1.hyps(6-8)] Call\<^sub>1.hyps(5) Call\<^sub>1.prems(1) by simp
   finally have 1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>2'".
   have "P\<^sub>1 \<turnstile> Ca sees M',NonStatic: Ts\<rightarrow>T = body in D" by fact
   then have M'_in_D: "P\<^sub>1 \<turnstile> D sees M',NonStatic: Ts\<rightarrow>T = body in D"
     by(rule sees_method_idemp) 
   have M'_code: "compP\<^sub>2 P\<^sub>1,D,M',0 \<rhd> compE\<^sub>2 body @ [Return]" using beforeM M'_in_D by simp
   have M'_xtab: "compP\<^sub>2 P\<^sub>1,D,M' \<rhd> compxE\<^sub>2 body 0 0/{..<size(compE\<^sub>2 body)},0"
     using M'_in_D by(rule beforexM)
   have IH_body: "PROP ?P body h\<^sub>2 ls\<^sub>2' sh\<^sub>2 f h\<^sub>3 ls\<^sub>3 sh\<^sub>3 (Class D # Ts) D M' 0 No_ics v xa [] ?frs\<^sub>2
     ({..<size(compE\<^sub>2 body)})" by fact
   have cond: "Jcc_cond P\<^sub>1 (Class D # Ts) D M' [] 0 No_ics {..<length (compE\<^sub>2 body)} h\<^sub>2 sh\<^sub>2 body"
     using nsub_RI_Jcc_pieces[OF assms(1) nsub] M'_code M'_xtab by clarsimp
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note 1
       also have "P \<turnstile> ?\<sigma>\<^sub>2' -jvm\<rightarrow> (None,h\<^sub>3,([v],ls\<^sub>3,D,M',size(compE\<^sub>2 body),No_ics)#?frs\<^sub>2,sh\<^sub>3)"
         using val IH_body Call\<^sub>1.prems M'_code cond nsub_RI_Jcc_pieces nsub by auto
       also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None, h\<^sub>3, (v#vs, ls\<^sub>2, C,M,?pc\<^sub>2+1,ics)#frs,sh\<^sub>3)"
         using Call\<^sub>1.hyps(7) M'_code M'_in_D nclinit by(cases T, auto)
       finally show ?trans by(simp add:add.assoc)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> ?err")
     proof
       assume throw: ?throw
       with IH_body obtain pc\<^sub>2 vs' where
         pc\<^sub>2: "0 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < size(compE\<^sub>2 body) \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>3 xa (compxE\<^sub>2 body 0 0)" and
         2: "P \<turnstile> ?\<sigma>\<^sub>2' -jvm\<rightarrow> handle P D M' xa h\<^sub>3 vs' ls\<^sub>3 pc\<^sub>2 No_ics ?frs\<^sub>2 sh\<^sub>3"
         using Call\<^sub>1.prems M'_code M'_xtab cond nsub_RI_Jcc_pieces nsub
          by (auto simp del:split_paired_Ex)
       have "handle P D M' xa h\<^sub>3 vs' ls\<^sub>3 pc\<^sub>2 No_ics ?frs\<^sub>2 sh\<^sub>3 =
             handle P C M xa h\<^sub>3 (rev pvs @ Addr a # vs) ls\<^sub>2 ?pc\<^sub>2 ics frs sh\<^sub>3"
         using pc\<^sub>2 M'_in_D nclinit by(auto simp add:handle_def)
       then show "?err" using pc\<^sub>2 jvm_trans[OF 1 2]
        by(auto intro!:exI[where x="?pc\<^sub>2"] exI[where x="rev pvs@[Addr a]"])
     qed
   qed
 next
   case (CallParamsThrow\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 w h\<^sub>1 ls\<^sub>1 sh\<^sub>1 es es' h\<^sub>2 ls\<^sub>2 sh\<^sub>2 pvs ex es'' M')
   let ?frs\<^sub>0 = "(vs, ls\<^sub>0, C,M,pc,ics)#frs"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs, ls\<^sub>0, C,M,pc,ics)#frs,sh\<^sub>0)"
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(w # vs, ls\<^sub>1, C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compEs\<^sub>2 es)"
   obtain err where pcs:
     "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e\<bullet>M'(es)) =
     (True, ?frs\<^sub>0, (None, h\<^sub>2, (v#vs, ls\<^sub>2, C,M,?pc\<^sub>2+1,ics)#frs,sh\<^sub>2), err)"
    using CallParamsThrow\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (Val w) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics w xa vs frs
     (I - pcs (compxEs\<^sub>2 es (pc + length (compE\<^sub>2 e)) (Suc (length vs))))" by fact
   have 1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1" using Jcc_pieces_Call1[OF pcs] IH by clarsimp
   have Isubs: "{?pc\<^sub>1..<?pc\<^sub>2} \<subseteq> I - pcs (compxE\<^sub>2 e pc (length vs))"
     using CallParamsThrow\<^sub>1.prems by clarsimp
   show ?case (is "?N \<and> (?eq \<longrightarrow> ?err)")
   proof
     show ?N by simp
   next
     { assume ?eq
       moreover
       have "PROP ?Ps es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 es' h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C M ?pc\<^sub>1 ics pvs xa es'' (w#vs) frs
         (I - pcs (compxE\<^sub>2 e pc (length vs)))" by fact
       ultimately obtain vs' where "\<exists>pc\<^sub>2.
         (?pc\<^sub>1 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>1 + size(compEs\<^sub>2 es) \<and>
          \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxEs\<^sub>2 es ?pc\<^sub>1 (size vs + 1))) \<and>
         P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (vs'@w#vs) ls\<^sub>2 pc\<^sub>2 ics frs sh\<^sub>2"
         (is "\<exists>pc\<^sub>2. ?PC pc\<^sub>2 \<and> ?Exec pc\<^sub>2")
         using CallParamsThrow\<^sub>1 Isubs by auto
       then obtain pc\<^sub>2 where pc\<^sub>2: "?PC pc\<^sub>2" and 2: "?Exec pc\<^sub>2" by iprover
       then have "?err" using pc\<^sub>2 jvm_trans[OF 1 2]
        by(auto intro!: exI[where x="pc\<^sub>2"] exI[where x="vs'@[w]"])
     }
     thus "?eq \<longrightarrow> ?err" by simp
   qed
 next
   case (CallNull\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 es pvs h\<^sub>2 ls\<^sub>2 sh\<^sub>2 M')
   have "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>es,(h\<^sub>1, ls\<^sub>1, sh\<^sub>1)\<rangle> [\<Rightarrow>] \<langle>map Val pvs,(h\<^sub>2, ls\<^sub>2, sh\<^sub>2)\<rangle>" by fact
   hence [simp]: "length es = length pvs" by(auto dest:evals\<^sub>1_preserves_elen)
   let ?frs\<^sub>0 = "(vs, ls\<^sub>0, C,M,pc,ics)#frs"
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compEs\<^sub>2 es)"
   let ?xa = "addr_of_sys_xcpt NullPointer"
   obtain err where pcs:
     "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e\<bullet>M'(es)) =
     (True, ?frs\<^sub>0, (None, h\<^sub>2, (v#vs, ls\<^sub>2, C,M,?pc\<^sub>2+1,ics)#frs,sh\<^sub>2), err)"
    using CallNull\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 null h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics Null xa vs frs
     (I - pcs (compxEs\<^sub>2 es (pc + length (compE\<^sub>2 e)) (Suc (length vs))))" by fact
   have IH_es: "PROP ?Ps es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (map Val pvs) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C M ?pc\<^sub>1 ics pvs xa
                     (map Val pvs) (Null#vs) frs (I - pcs(compxE\<^sub>2 e pc (size vs)))" by fact
   have Isubs: "{pc + length (compE\<^sub>2 e)..<pc + length (compE\<^sub>2 e) + length (compEs\<^sub>2 es)}
      \<subseteq> I - pcs (compxE\<^sub>2 e pc (length vs))" using CallNull\<^sub>1.prems by clarsimp
   have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0) -jvm\<rightarrow>
              (None,h\<^sub>1,(Null#vs,ls\<^sub>1,C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
     using Jcc_pieces_Call1[OF pcs] IH by clarsimp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(rev pvs@Null#vs,ls\<^sub>2,C,M,?pc\<^sub>2,ics)#frs,sh\<^sub>2)"
     using CallNull\<^sub>1 IH_es Isubs by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>2 (rev pvs@Null#vs) ls\<^sub>2 ?pc\<^sub>2 ics frs sh\<^sub>2"
     using CallNull\<^sub>1.prems
     by(auto simp:split_beta handle_def nth_append simp del: split_paired_Ex)
   finally show ?case by (auto intro!: exI[where x = ?pc\<^sub>2] exI[where x="rev pvs@[Null]"])
 next
   case (CallObjThrow\<^sub>1 e h ls sh e' h' ls' sh' M' es)
   obtain err where pcs:
     "Jcc_pieces P\<^sub>1 E C M h vs ls pc ics frs sh I h' ls' sh' v xa (e\<bullet>M'(es)) =
     (True, (vs, ls, C,M,pc,ics)#frs,
        (None, h', (v#vs, ls', C,M,pc+size(compE\<^sub>2 (e\<bullet>M'(es))),ics)#frs,sh'), err)"
    using CallObjThrow\<^sub>1.prems(1) by clarsimp
   obtain a' where throw: "throw e' = Throw a'"
     using eval\<^sub>1_final[OF CallObjThrow\<^sub>1.hyps(1)] by clarsimp
   have IH: "PROP ?P e h ls sh (throw e') h' ls' sh' E C M pc ics v a' vs frs
     (I - pcs (compxEs\<^sub>2 es (pc + length (compE\<^sub>2 e)) (Suc (length vs))))" by fact
   show ?case using IH Jcc_pieces_Call1[OF pcs] throw CallObjThrow\<^sub>1.prems nsub_RI_Jcc_pieces
     by auto
 next
   case (CallNone\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 es pvs h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C' fs M')
   let ?frs\<^sub>0 = "(vs, ls\<^sub>0, C,M,pc,ics)#frs"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,?frs\<^sub>0,sh\<^sub>0)"
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(Addr a#vs, ls\<^sub>1, C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compEs\<^sub>2 es)"
   let ?frs\<^sub>2 = "(rev pvs @ Addr a # vs, ls\<^sub>2, C,M,?pc\<^sub>2,ics)#frs"
   let ?\<sigma>\<^sub>2 = "(None,h\<^sub>2,?frs\<^sub>2,sh\<^sub>2)"
   let ?xa = "addr_of_sys_xcpt NoSuchMethodError"
   have "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>es,(h\<^sub>1, ls\<^sub>1, sh\<^sub>1)\<rangle> [\<Rightarrow>] \<langle>map Val pvs,(h\<^sub>2, ls\<^sub>2, sh\<^sub>2)\<rangle>" by fact
   hence [simp]: "length es = length pvs" by(auto dest:evals\<^sub>1_preserves_elen)
   have aux: "(rev pvs @ Addr a # vs) ! length pvs = Addr a"
     by (metis length_rev nth_append_length)
   have nmeth: "\<not>(\<exists>b Ts T body D. P \<turnstile> C' sees M', b :  Ts\<rightarrow>T = body in D)"
     using sees_method_compPD CallNone\<^sub>1.hyps(6) by fastforce
   obtain err where pcs:
     "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e\<bullet>M'(es)) =
     (True, ?frs\<^sub>0, (None, h\<^sub>2, (v#vs, ls\<^sub>2, C,M,?pc\<^sub>2+1,ics)#frs,sh\<^sub>2), err)"
    using CallNone\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (addr a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Addr a) xa vs frs
     (I - pcs (compxEs\<^sub>2 es (pc + length (compE\<^sub>2 e)) (Suc (length vs))))" by fact
   have IH_es: "PROP ?Ps es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (map Val pvs) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C M ?pc\<^sub>1 ics pvs xa
                     (map Val pvs) (Addr a#vs) frs (I - pcs(compxE\<^sub>2 e pc (size vs)))" by fact
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1" using Jcc_pieces_Call1[OF pcs] IH by clarsimp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>2" using IH_es CallNone\<^sub>1.prems by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>2 (rev pvs@Addr a#vs) ls\<^sub>2 ?pc\<^sub>2 ics frs sh\<^sub>2"
     using CallNone\<^sub>1.hyps(5) CallNone\<^sub>1.prems aux nmeth
      by(cases "method P C' M'", cases "find_handler P ?xa h\<^sub>2 frs sh\<^sub>2", auto simp: handle_def)
   finally show ?case using pcs by (auto intro!: exI[where x = ?pc\<^sub>2] exI[where x="rev pvs@[Addr a]"])
 next
   case (CallStatic\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 es pvs h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C' fs M' Ts T body D)
   let ?frs\<^sub>0 = "(vs, ls\<^sub>0, C,M,pc,ics)#frs"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,?frs\<^sub>0,sh\<^sub>0)"
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(Addr a#vs, ls\<^sub>1, C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compEs\<^sub>2 es)"
   let ?frs\<^sub>2 = "(rev pvs @ Addr a # vs, ls\<^sub>2, C,M,?pc\<^sub>2,ics)#frs"
   let ?\<sigma>\<^sub>2 = "(None,h\<^sub>2,?frs\<^sub>2,sh\<^sub>2)"
   let ?xa = "addr_of_sys_xcpt IncompatibleClassChangeError"
   have "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>es,(h\<^sub>1, ls\<^sub>1, sh\<^sub>1)\<rangle> [\<Rightarrow>] \<langle>map Val pvs,(h\<^sub>2, ls\<^sub>2, sh\<^sub>2)\<rangle>" by fact
   hence [simp]: "length es = length pvs" by(auto dest:evals\<^sub>1_preserves_elen)
   have aux: "(rev pvs @ Addr a # vs) ! length pvs = Addr a"
     by (metis length_rev nth_append_length)
   obtain body' where method: "P \<turnstile> C' sees M', Static :  Ts\<rightarrow>T = body' in D"
     by (metis CallStatic\<^sub>1.hyps(6) P_def compP\<^sub>2_def sees_method_compP)
   obtain err where pcs:
     "Jcc_pieces P\<^sub>1 E C M h\<^sub>0 vs ls\<^sub>0 pc ics frs sh\<^sub>0 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (e\<bullet>M'(es)) =
     (True, ?frs\<^sub>0, (None, h\<^sub>2, (v#vs, ls\<^sub>2, C,M,?pc\<^sub>2+1,ics)#frs,sh\<^sub>2), err)"
    using CallStatic\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (addr a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Addr a) xa vs frs
     (I - pcs (compxEs\<^sub>2 es (pc + length (compE\<^sub>2 e)) (Suc (length vs))))" by fact
   have IH_es: "PROP ?Ps es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (map Val pvs) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C M ?pc\<^sub>1 ics pvs xa
                     (map Val pvs) (Addr a#vs) frs (I - pcs(compxE\<^sub>2 e pc (size vs)))" by fact
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1" using Jcc_pieces_Call1[OF pcs] IH by clarsimp
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>2" using IH_es CallStatic\<^sub>1.prems by fastforce
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>2 (rev pvs@Addr a#vs) ls\<^sub>2 ?pc\<^sub>2 ics frs sh\<^sub>2"
     using CallStatic\<^sub>1.hyps(5) CallStatic\<^sub>1.prems aux method
      by(cases "method P C' M'", cases "find_handler P ?xa h\<^sub>2 frs sh\<^sub>2")
        (auto simp: handle_def; meson frames_of.cases)
   finally show ?case using pcs by (auto intro!: exI[where x = ?pc\<^sub>2] exI[where x="rev pvs@[Addr a]"])
 next
   case (SCallParamsThrow\<^sub>1 es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 es' h\<^sub>2 ls\<^sub>2 sh\<^sub>2 pvs ex es'' C' M')
   show ?case
   proof(cases "M' = clinit \<and> es = []")
     case clinit: True then show ?thesis
       using SCallParamsThrow\<^sub>1.hyps(1,3) evals\<^sub>1_cases(1) by fastforce
   next
     case nclinit: False
     let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs, ls\<^sub>1, C,M,pc,ics)#frs,sh\<^sub>1)"
     let ?pc\<^sub>2 = "pc + length(compEs\<^sub>2 es)"
     have Isubs: "{pc..<pc + length (compEs\<^sub>2 es)} \<subseteq> I" using SCallParamsThrow\<^sub>1.prems nclinit by clarsimp
     show ?thesis (is "?N \<and> (?eq \<longrightarrow> ?err)")
     proof
       show ?N by simp
     next
       { assume ?eq
         moreover
         have "PROP ?Ps es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 es' h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C M pc ics pvs xa es'' vs frs I" by fact
         ultimately have "\<exists>pc\<^sub>2.
           (pc \<le> pc\<^sub>2 \<and> pc\<^sub>2 < pc + size(compEs\<^sub>2 es) \<and>
            \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxEs\<^sub>2 es pc (size vs))) \<and>
           (\<exists>vs'. P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (vs'@vs) ls\<^sub>2 pc\<^sub>2 ics frs sh\<^sub>2)"
           (is "\<exists>pc\<^sub>2. ?PC pc\<^sub>2 \<and> ?Exec pc\<^sub>2")
           using SCallParamsThrow\<^sub>1 Isubs nclinit by auto
         then obtain pc\<^sub>2 where pc\<^sub>2: "?PC pc\<^sub>2" and 2: "?Exec pc\<^sub>2" by iprover
         then have "?err" using pc\<^sub>2 2 by(auto intro: exI[where x="pc\<^sub>2"])
       }
       thus "?eq \<longrightarrow> ?err" by iprover
     qed
   qed
 next
   case (SCallNone\<^sub>1 es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 pvs h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C' M')
   show ?case
   proof(cases "M' = clinit \<and> es = []")
     case clinit: True then show ?thesis using SCallNone\<^sub>1.hyps(3) SCallNone\<^sub>1.prems by auto
   next
     case nclinit: False
     let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs, ls\<^sub>1, C,M,pc,ics)#frs,sh\<^sub>1)"
     let ?pc\<^sub>2 = "pc + length(compEs\<^sub>2 es)"
     let ?frs\<^sub>2 = "(rev pvs @ vs, ls\<^sub>2, C,M,?pc\<^sub>2,ics)#frs"
     let ?\<sigma>\<^sub>2 = "(None,h\<^sub>2,?frs\<^sub>2,sh\<^sub>2)"
     let ?xa = "addr_of_sys_xcpt NoSuchMethodError"
     have "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>es,(h\<^sub>1, ls\<^sub>1, sh\<^sub>1)\<rangle> [\<Rightarrow>] \<langle>map Val pvs,(h\<^sub>2, ls\<^sub>2, sh\<^sub>2)\<rangle>" by fact
     hence [simp]: "length es = length pvs" by(auto dest:evals\<^sub>1_preserves_elen)
     have nmeth: "\<not>(\<exists>b Ts T body D. P \<turnstile> C' sees M', b :  Ts\<rightarrow>T = body in D)"
       using sees_method_compPD SCallNone\<^sub>1.hyps(3) by fastforce
     have IH_es: "PROP ?Ps es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (map Val pvs) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C M pc ics pvs xa
                       (map Val pvs) vs frs I" by fact
     have "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> ?\<sigma>\<^sub>2" using IH_es SCallNone\<^sub>1.prems nclinit by auto fastforce+
     also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>2 (rev pvs@vs) ls\<^sub>2 ?pc\<^sub>2 ics frs sh\<^sub>2"
       using SCallNone\<^sub>1.prems nmeth nclinit
        by(cases "method P C' M'", cases "find_handler P ?xa h\<^sub>2 frs sh\<^sub>2", auto simp: handle_def)
     finally show ?thesis using nclinit by (auto intro: exI[where x = ?pc\<^sub>2])
   qed
 next
   case (SCallNonStatic\<^sub>1 es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 pvs h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C' M' Ts T body D)
   show ?case
   proof(cases "M' = clinit \<and> es = []")
     case clinit: True then show ?thesis
       using SCallNonStatic\<^sub>1.hyps(3) SCallNonStatic\<^sub>1.prems sees_method_fun by fastforce
   next
     case nclinit: False
     let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs, ls\<^sub>1, C,M,pc,ics)#frs,sh\<^sub>1)"
     let ?pc\<^sub>2 = "pc + length(compEs\<^sub>2 es)"
     let ?frs\<^sub>2 = "(rev pvs @ vs, ls\<^sub>2, C,M,?pc\<^sub>2,ics)#frs"
     let ?\<sigma>\<^sub>2 = "(None,h\<^sub>2,?frs\<^sub>2,sh\<^sub>2)"
     let ?xa = "addr_of_sys_xcpt IncompatibleClassChangeError"
     have "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>es,(h\<^sub>1, ls\<^sub>1, sh\<^sub>1)\<rangle> [\<Rightarrow>] \<langle>map Val pvs,(h\<^sub>2, ls\<^sub>2, sh\<^sub>2)\<rangle>" by fact
     hence [simp]: "length es = length pvs" by(auto dest:evals\<^sub>1_preserves_elen)
     obtain body' where method: "P \<turnstile> C' sees M', NonStatic :  Ts\<rightarrow>T = body' in D"
       by (metis SCallNonStatic\<^sub>1.hyps(3) P_def compP\<^sub>2_def sees_method_compP)
     have IH_es: "PROP ?Ps es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (map Val pvs) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C M pc ics pvs xa
                       (map Val pvs) vs frs I" by fact
     have "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> ?\<sigma>\<^sub>2" using IH_es SCallNonStatic\<^sub>1.prems nclinit by auto fastforce+
     also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M ?xa h\<^sub>2 (rev pvs@vs) ls\<^sub>2 ?pc\<^sub>2 ics frs sh\<^sub>2"
       using SCallNonStatic\<^sub>1.prems method nclinit
        by(cases "method P C' M'", cases "find_handler P ?xa h\<^sub>2 frs sh\<^sub>2")
          (auto simp: handle_def; meson frames_of.cases)
     finally show ?thesis using nclinit by (auto intro: exI[where x = ?pc\<^sub>2])
   qed
 next
   case (SCallInitThrow\<^sub>1 es h\<^sub>0 ls\<^sub>0 sh\<^sub>0 pvs h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C' M' Ts T body D a h\<^sub>2 ls\<^sub>2 sh\<^sub>2)
   show ?case
   proof(cases "M' = clinit \<and> es = []")
     case clinit: True then show ?thesis using SCallInitThrow\<^sub>1 by simp
   next
     case nclinit: False
     let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs, ls\<^sub>0, C,M,pc,ics)#frs,sh\<^sub>0)"
     let ?pc\<^sub>1 = "pc + length(compEs\<^sub>2 es)"
     let ?frs\<^sub>1 = "(rev pvs @ vs, ls\<^sub>1, C,M,?pc\<^sub>1,ics)#frs"
     let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,?frs\<^sub>1,sh\<^sub>1)"
     let ?frs\<^sub>1' = "(rev pvs@vs,ls\<^sub>1,C,M,?pc\<^sub>1,Calling D [])#frs"
     let ?\<sigma>\<^sub>1' = "(None,h\<^sub>1,?frs\<^sub>1',sh\<^sub>1)"
     let ?frs\<^sub>2 = "(rev pvs@vs,ls\<^sub>1,C,M,?pc\<^sub>1,Called [])#frs"
     let ?\<sigma>\<^sub>2 = "(None,h\<^sub>2,?frs\<^sub>2,sh\<^sub>2)"
     have ls: "ls\<^sub>1 = ls\<^sub>2" by(rule init\<^sub>1_same_loc[OF SCallInitThrow\<^sub>1.hyps(6)])
     have method: "\<exists>m'. P \<turnstile> C' sees M',Static:Ts\<rightarrow>T = m' in D" using SCallInitThrow\<^sub>1.hyps(3)
       by (metis P_def compP\<^sub>2_def sees_method_compP)
     obtain a' where throw: "throw a = Throw a'" using eval\<^sub>1_final[OF SCallInitThrow\<^sub>1.hyps(6)] by clarsimp
     have "Ex (WTrt2\<^sub>1 P\<^sub>1 E h\<^sub>1 sh\<^sub>1 (INIT D ([D],False) \<leftarrow> unit))"
       using sees_method_is_class'[OF SCallInitThrow\<^sub>1.hyps(3)] by auto
     then obtain err' where pcs':
       "Jcc_pieces P\<^sub>1 E C M h\<^sub>1 (rev pvs@vs) ls\<^sub>1 ?pc\<^sub>1 ics frs sh\<^sub>1 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v xa (INIT D ([D],False) \<leftarrow> unit)
       = (True, ?frs\<^sub>1', (None,h\<^sub>2,?frs\<^sub>2,sh\<^sub>2), err')"
       using SCallInitThrow\<^sub>1.prems(1) nclinit by auto
     have IHI: "PROP ?P (INIT D ([D],False) \<leftarrow> unit) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (throw a)
                h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M ?pc\<^sub>1 ics v a' (rev pvs@vs) frs I" by fact
     have IH_es: "PROP ?Ps es h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (map Val pvs) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C M pc ics pvs xa
                       (map Val pvs) vs frs I" by fact
     have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1" using IH_es SCallInitThrow\<^sub>1.prems nclinit by auto fastforce+
     also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1'"
     proof(cases "sh\<^sub>1 D")
       case None then show ?thesis using SCallInitThrow\<^sub>1.hyps(1,3-6) SCallInitThrow\<^sub>1.prems method
         by(cases ics) auto
     next
       case (Some a)
       then obtain sfs i where "a = (sfs,i)" by(cases a)
       then show ?thesis using SCallInitThrow\<^sub>1.hyps(1,3-6) SCallInitThrow\<^sub>1.prems method Some
         by(cases ics; case_tac i, auto)
     qed
     also obtain vs' where "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M a' h\<^sub>2 (vs'@rev pvs@vs) ls\<^sub>1 ?pc\<^sub>1 ics frs sh\<^sub>2"
       using IHI pcs' throw by auto
     finally show ?thesis using nclinit throw ls
      by(auto intro!: exI[where x="?pc\<^sub>1"] exI[where x="vs'@rev pvs"])
   qed
 next
   case (SCallInit\<^sub>1 es h\<^sub>0 ls\<^sub>0 sh\<^sub>0 pvs h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C' M' Ts T body D v' h\<^sub>2 ls\<^sub>2 sh\<^sub>2 ls\<^sub>2' e' h\<^sub>3 ls\<^sub>3 sh\<^sub>3)
   show ?case
   proof(cases "M' = clinit \<and> es = []")
     case clinit: True then show ?thesis using SCallInit\<^sub>1 by simp
   next
     case nclinit: False
     let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs, ls\<^sub>0, C,M,pc,ics)#frs,sh\<^sub>0)"
     let ?pc\<^sub>1 = "pc + length(compEs\<^sub>2 es)"
     let ?frs\<^sub>1 = "(rev pvs @ vs, ls\<^sub>1, C,M,?pc\<^sub>1,ics)#frs"
     let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,?frs\<^sub>1,sh\<^sub>1)"
     let ?frs\<^sub>1' = "(rev pvs@vs,ls\<^sub>1,C,M,?pc\<^sub>1,Calling D [])#frs"
     let ?\<sigma>\<^sub>1' = "(None,h\<^sub>1,?frs\<^sub>1',sh\<^sub>1)"
     let ?frs\<^sub>2 = "(rev pvs@vs,ls\<^sub>1,C,M,?pc\<^sub>1,Called [])#frs"
     let ?\<sigma>\<^sub>2 = "(None,h\<^sub>2,?frs\<^sub>2,sh\<^sub>2)"
     let ?frs\<^sub>2' = "([], ls\<^sub>2', D,M',0,No_ics) # ?frs\<^sub>1"
     let ?\<sigma>\<^sub>2' = "(None, h\<^sub>2, ?frs\<^sub>2', sh\<^sub>2)"
     have nclinit': "M' \<noteq> clinit" by fact
     have ics: "ics = No_ics" using SCallInit\<^sub>1.hyps(5) SCallInit\<^sub>1.prems by simp
     have "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>es,(h\<^sub>0, ls\<^sub>0, sh\<^sub>0)\<rangle> [\<Rightarrow>] \<langle>map Val pvs,(h\<^sub>1, ls\<^sub>1, sh\<^sub>1)\<rangle>" by fact
     hence [simp]: "length es = length pvs" by(auto dest:evals\<^sub>1_preserves_elen)
     have invoke: "P,C,M,?pc\<^sub>1 \<triangleright> Invokestatic C' M' (length Ts)"
       using SCallInit\<^sub>1.hyps(8) SCallInit\<^sub>1.prems nclinit by(auto simp: add.assoc)
     have nsub: "\<not> sub_RI body" by(rule sees_wf\<^sub>1_nsub_RI[OF wf SCallInit\<^sub>1.hyps(3)])
     have ls: "ls\<^sub>1 = ls\<^sub>2" by(rule init\<^sub>1_same_loc[OF SCallInit\<^sub>1.hyps(6)])
     obtain sfs i where sh\<^sub>2: "sh\<^sub>2 D = Some(sfs,i)"
       using init\<^sub>1_Val_PD[OF SCallInit\<^sub>1.hyps(6)] by clarsimp
     have method: "\<exists>m'. P \<turnstile> C' sees M',Static:Ts\<rightarrow>T = m' in D" using SCallInit\<^sub>1.hyps(3)
       by (metis P_def compP\<^sub>2_def sees_method_compP)
     have "Ex (WTrt2\<^sub>1 P\<^sub>1 E h\<^sub>1 sh\<^sub>1 (INIT D ([D],False) \<leftarrow> unit))"
       using sees_method_is_class'[OF SCallInit\<^sub>1.hyps(3)] by auto
     then obtain err' where pcs':
       "Jcc_pieces P\<^sub>1 E C M h\<^sub>1 (rev pvs@vs) ls\<^sub>1 ?pc\<^sub>1 ics frs sh\<^sub>1 I h\<^sub>2 ls\<^sub>2 sh\<^sub>2 v' xa (INIT D ([D],False) \<leftarrow> unit)
       = (True, ?frs\<^sub>1', (None,h\<^sub>2,?frs\<^sub>2,sh\<^sub>2), err')"
       using SCallInit\<^sub>1.prems(1) nclinit by auto
     have IHI: "PROP ?P (INIT D ([D],False) \<leftarrow> unit) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (Val v')
                h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M ?pc\<^sub>1 ics v' xa (rev pvs@vs) frs I" by fact
     have IH_es: "PROP ?Ps es h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (map Val pvs) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 C M pc ics pvs xa
                       (map Val pvs) vs frs I" by fact
     have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1" using IH_es SCallInit\<^sub>1.prems nclinit by auto fastforce+
     also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1'"
     proof(cases "sh\<^sub>1 D")
       case None then show ?thesis using SCallInit\<^sub>1.hyps(1,3-6,8-10) SCallInit\<^sub>1.prems method
         by(cases ics) auto
     next
       case (Some a)
       then obtain sfs i where "a = (sfs,i)" by(cases a)
       then show ?thesis using SCallInit\<^sub>1.hyps(1,3-6,8-10) SCallInit\<^sub>1.prems method Some
         by(cases ics; case_tac i, auto)
     qed
     also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>2" using IHI pcs' by auto
     also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>2'"
       using jvm_Invokestatic_Called[OF assms(1) invoke _ SCallInit\<^sub>1.hyps(3,8,9)] sh\<^sub>2 ics by auto
     finally have 1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>2'".
     have "P\<^sub>1 \<turnstile> C' sees M',Static: Ts\<rightarrow>T = body in D" by fact
     then have M'_in_D: "P\<^sub>1 \<turnstile> D sees M',Static: Ts\<rightarrow>T = body in D"
       by(rule sees_method_idemp) 
     have M'_code: "compP\<^sub>2 P\<^sub>1,D,M',0 \<rhd> compE\<^sub>2 body @ [Return]" using beforeM M'_in_D by simp
     have M'_xtab: "compP\<^sub>2 P\<^sub>1,D,M' \<rhd> compxE\<^sub>2 body 0 0/{..<size(compE\<^sub>2 body)},0"
       using M'_in_D by(rule beforexM)
     have IH_body: "PROP ?P body h\<^sub>2 ls\<^sub>2' sh\<^sub>2 e' h\<^sub>3 ls\<^sub>3 sh\<^sub>3 (Class D # Ts) D M' 0 No_ics v xa [] ?frs\<^sub>1
       ({..<size(compE\<^sub>2 body)})" by fact
     have cond: "Jcc_cond P\<^sub>1 (Class D # Ts) D M' [] 0 No_ics {..<length (compE\<^sub>2 body)} h\<^sub>2 sh\<^sub>2 body"
       using nsub_RI_Jcc_pieces[OF assms(1) nsub] M'_code M'_xtab by clarsimp
     show ?thesis (is "?Norm \<and> ?Err")
     proof
       show ?Norm (is "?val \<longrightarrow> ?trans")
       proof
         assume val: ?val
         note 1
         also have "P \<turnstile> ?\<sigma>\<^sub>2' -jvm\<rightarrow> (None,h\<^sub>3,([v],ls\<^sub>3,D,M',size(compE\<^sub>2 body),No_ics)#?frs\<^sub>1,sh\<^sub>3)"
           using val IH_body SCallInit\<^sub>1.prems M'_code cond nsub_RI_Jcc_pieces nsub by auto
         also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None, h\<^sub>3, (v#vs, ls\<^sub>2, C,M,?pc\<^sub>1+1,ics)#frs,sh\<^sub>3)"
           using SCallInit\<^sub>1.hyps(8) M'_code M'_in_D ls nclinit' by(cases T, auto)
         finally show ?trans using nclinit by(auto simp:add.assoc)
       qed
     next
       show ?Err (is "?throw \<longrightarrow> ?err")
       proof
         assume throw: ?throw
         with IH_body obtain pc\<^sub>2 vs' where
           pc\<^sub>2: "0 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < size(compE\<^sub>2 body) \<and>
                 \<not> caught P pc\<^sub>2 h\<^sub>3 xa (compxE\<^sub>2 body 0 0)" and
           2: "P \<turnstile> ?\<sigma>\<^sub>2' -jvm\<rightarrow> handle P D M' xa h\<^sub>3 vs' ls\<^sub>3 pc\<^sub>2 No_ics ?frs\<^sub>1 sh\<^sub>3"
           using SCallInit\<^sub>1.prems M'_code M'_xtab cond nsub_RI_Jcc_pieces nsub
            by (auto simp del:split_paired_Ex)
         have "handle P D M' xa h\<^sub>3 vs' ls\<^sub>3 pc\<^sub>2 No_ics ?frs\<^sub>1 sh\<^sub>3 =
               handle P C M xa h\<^sub>3 (rev pvs @ vs) ls\<^sub>2 ?pc\<^sub>1 ics frs sh\<^sub>3"
           using pc\<^sub>2 M'_in_D ls nclinit' by(auto simp add:handle_def)
         then show "?err" using pc\<^sub>2 jvm_trans[OF 1 2] nclinit
          by(auto intro!:exI[where x="?pc\<^sub>1"] exI[where x="rev pvs"])
       qed
     qed
   qed
 next
   case (SCall\<^sub>1 es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 pvs h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C' M' Ts T body D sfs ls\<^sub>2' e' h\<^sub>3 ls\<^sub>3 sh\<^sub>3)
   show ?case
   proof(cases "M' = clinit \<and> es = []")
     case clinit: True
     then have s1: "pvs = []" "h\<^sub>1 = h\<^sub>2" "ls\<^sub>1 = ls\<^sub>2" "sh\<^sub>1 = sh\<^sub>2"
       using SCall\<^sub>1.hyps(1) evals\<^sub>1_cases(1) by blast+
     then have ls\<^sub>2': "ls\<^sub>2' = replicate (max_vars body) undefined" using SCall\<^sub>1.hyps(6) clinit by simp
     let ?frs = "create_init_frame P C' # (vs, ls\<^sub>1, C,M,pc,ics)#frs"
     let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,?frs,sh\<^sub>1)"
     have method: "P\<^sub>1 \<turnstile> C' sees clinit,Static: []\<rightarrow>Void = body in C'"
       using SCall\<^sub>1.hyps(3) clinit s1(1) wf_sees_clinit[OF wf]
         by (metis is_class_def option.collapse sees_method_fun sees_method_is_class)
     then have M_code: "compP\<^sub>2 P\<^sub>1,C',clinit,0 \<rhd> compE\<^sub>2 body @ [Return]" by(rule beforeM)
     have pcs: "Jcc_pieces P\<^sub>1 E C M h\<^sub>1 vs ls\<^sub>1 pc ics frs sh\<^sub>1 I h\<^sub>3 ls\<^sub>2 sh\<^sub>3 v xa (C'\<bullet>\<^sub>sclinit([]))
          = (True, ?frs, (None, h\<^sub>3, tl ?frs, sh\<^sub>3(C'\<mapsto>(fst(the(sh\<^sub>3 C')),Done))),
         P \<turnstile> (None, h\<^sub>1, ?frs, sh\<^sub>1) -jvm\<rightarrow>
         (case ics of
      Called Cs \<Rightarrow> (None, h\<^sub>3, (vs, ls\<^sub>1, C, M, pc, Throwing Cs xa) # frs, sh\<^sub>3(C' \<mapsto> (fst (the (sh\<^sub>3 C')), Error)))))"
       using Jcc_pieces_clinit[OF assms(1),of E C M vs pc ics I h\<^sub>1 sh\<^sub>1 C' ls\<^sub>1 frs h\<^sub>3 ls\<^sub>2 sh\<^sub>3 v xa]
          SCall\<^sub>1.prems(1) clinit s1(1) by clarsimp
     have IH_body: "PROP ?P body h\<^sub>2 ls\<^sub>2' sh\<^sub>2 e' h\<^sub>3 ls\<^sub>3 sh\<^sub>3 [] C' clinit 0 No_ics v xa [] (tl ?frs)
      ({..<size(compE\<^sub>2 body)})" by fact
     show ?thesis (is "?Norm \<and> ?Err")
     proof
       show ?Norm (is "?val \<longrightarrow> ?trans")
       proof
         assume val: ?val
         then have "P \<turnstile> ?\<sigma>\<^sub>1
            -jvm\<rightarrow> (None, h\<^sub>3, ([v], ls\<^sub>3, C', clinit, size(compE\<^sub>2 body), No_ics) # tl ?frs,sh\<^sub>3)"
           using IH_body Jcc_pieces_SCall_clinit_body[OF assms(1) wf pcs method] s1 ls\<^sub>2' by clarsimp
         also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None, h\<^sub>3, tl ?frs, sh\<^sub>3(C'\<mapsto>(fst(the(sh\<^sub>3 C')),Done)))"
           using jvm_Return_Init[OF M_code] by simp
         finally show ?trans using pcs s1 clinit by simp
       qed
     next
       show ?Err (is "?throw \<longrightarrow> ?err")
       proof
         assume throw: ?throw
         with IH_body obtain pc\<^sub>2 vs2 where
           pc\<^sub>2: "0 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < size(compE\<^sub>2 body) \<and>
                 \<not> caught P pc\<^sub>2 h\<^sub>3 xa (compxE\<^sub>2 body 0 0)" and
           2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C' clinit xa h\<^sub>3 vs2 ls\<^sub>3 pc\<^sub>2 No_ics (tl ?frs) sh\<^sub>3"
           using SCall\<^sub>1.prems Jcc_pieces_SCall_clinit_body[OF assms(1) wf pcs method] s1 ls\<^sub>2' by clarsimp
         show ?err using SCall\<^sub>1.prems(1) clinit
         proof(cases ics)
           case (Called Cs)
           note 2
           also have "handle P C' clinit xa h\<^sub>3 vs2 ls\<^sub>3 pc\<^sub>2 No_ics (tl ?frs) sh\<^sub>3
              = (None, h\<^sub>3, (vs, ls\<^sub>1, C, M, pc, Throwing (C'#Cs) xa) # frs, sh\<^sub>3)"
             using Called pc\<^sub>2 method by(simp add: handle_def)
           also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None, h\<^sub>3, (vs, ls\<^sub>1, C, M, pc, Throwing Cs xa) # frs,
              sh\<^sub>3(C' \<mapsto> (fst (the (sh\<^sub>3 C')), Error)))" using Called jvm_Throwing by simp
           finally show ?thesis using pcs clinit Called by(clarsimp intro!: exI[where x="[]"])
         qed(auto)
       qed
     qed
   next
     case nclinit: False
     let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs, ls\<^sub>1, C,M,pc,ics)#frs,sh\<^sub>1)"
     let ?pc\<^sub>2 = "pc + length(compEs\<^sub>2 es)"
     let ?frs\<^sub>2 = "(rev pvs @ vs, ls\<^sub>2, C,M,?pc\<^sub>2,ics)#frs"
     let ?\<sigma>\<^sub>2 = "(None,h\<^sub>2,?frs\<^sub>2,sh\<^sub>2)"
     let ?frs\<^sub>2' = "([], ls\<^sub>2', D,M',0,No_ics) # ?frs\<^sub>2"
     let ?\<sigma>\<^sub>2' = "(None, h\<^sub>2, ?frs\<^sub>2', sh\<^sub>2)"
     have nclinit': "M' \<noteq> clinit"
      using wf_sees_clinit1[OF wf] visible_method_exists[OF SCall\<^sub>1.hyps(3)]
        sees_method_idemp[OF SCall\<^sub>1.hyps(3)] nclinit SCall\<^sub>1.hyps(5)
        evals\<^sub>1_preserves_elen[OF SCall\<^sub>1.hyps(1)] by fastforce
     have "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>es,(h\<^sub>1, ls\<^sub>1, sh\<^sub>1)\<rangle> [\<Rightarrow>] \<langle>map Val pvs,(h\<^sub>2, ls\<^sub>2, sh\<^sub>2)\<rangle>" by fact
     hence [simp]: "length es = length pvs" by(auto dest:evals\<^sub>1_preserves_elen)
     have invoke: "P,C,M,?pc\<^sub>2 \<triangleright> Invokestatic C' M' (length Ts)"
       using SCall\<^sub>1.hyps(5) SCall\<^sub>1.prems nclinit by(auto simp: add.assoc)
     have nsub: "\<not> sub_RI body" by(rule sees_wf\<^sub>1_nsub_RI[OF wf SCall\<^sub>1.hyps(3)])
     have IH_es: "PROP ?Ps es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (map Val pvs) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C M pc ics pvs xa
                       (map Val pvs) vs frs I" by fact
     have "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> ?\<sigma>\<^sub>2" using IH_es SCall\<^sub>1.prems nclinit by auto fastforce+
     also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>2'" using jvm_Invokestatic[OF assms(1) invoke _ SCall\<^sub>1.hyps(3,5,6)]
          SCall\<^sub>1.hyps(4) SCall\<^sub>1.prems nclinit by auto
     finally have 1: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> ?\<sigma>\<^sub>2'".
     have "P\<^sub>1 \<turnstile> C' sees M',Static: Ts\<rightarrow>T = body in D" by fact
     then have M'_in_D: "P\<^sub>1 \<turnstile> D sees M',Static: Ts\<rightarrow>T = body in D"
       by(rule sees_method_idemp) 
     have M'_code: "compP\<^sub>2 P\<^sub>1,D,M',0 \<rhd> compE\<^sub>2 body @ [Return]" using beforeM M'_in_D by simp
     have M'_xtab: "compP\<^sub>2 P\<^sub>1,D,M' \<rhd> compxE\<^sub>2 body 0 0/{..<size(compE\<^sub>2 body)},0"
       using M'_in_D by(rule beforexM)
     have IH_body: "PROP ?P body h\<^sub>2 ls\<^sub>2' sh\<^sub>2 e' h\<^sub>3 ls\<^sub>3 sh\<^sub>3 (Class D # Ts) D M' 0 No_ics v xa [] ?frs\<^sub>2
       ({..<size(compE\<^sub>2 body)})" by fact
     have cond: "Jcc_cond P\<^sub>1 (Class D # Ts) D M' [] 0 No_ics {..<length (compE\<^sub>2 body)} h\<^sub>2 sh\<^sub>2 body"
       using nsub_RI_Jcc_pieces[OF assms(1) nsub] M'_code M'_xtab by clarsimp
     show ?thesis (is "?Norm \<and> ?Err")
     proof
       show ?Norm (is "?val \<longrightarrow> ?trans")
       proof
         assume val: ?val
         note 1
         also have "P \<turnstile> ?\<sigma>\<^sub>2' -jvm\<rightarrow> (None,h\<^sub>3,([v],ls\<^sub>3,D,M',size(compE\<^sub>2 body),No_ics)#?frs\<^sub>2,sh\<^sub>3)"
           using val IH_body SCall\<^sub>1.prems M'_code cond nsub_RI_Jcc_pieces nsub by auto
         also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None, h\<^sub>3, (v#vs, ls\<^sub>2, C,M,?pc\<^sub>2+1,ics)#frs,sh\<^sub>3)"
           using SCall\<^sub>1.hyps(5) M'_code M'_in_D nclinit' by(cases T, auto)
         finally show ?trans using nclinit by(auto simp:add.assoc)
       qed
     next
       show ?Err (is "?throw \<longrightarrow> ?err")
       proof
         assume throw: ?throw
         with IH_body obtain pc\<^sub>2 vs' where
           pc\<^sub>2: "0 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < size(compE\<^sub>2 body) \<and>
                 \<not> caught P pc\<^sub>2 h\<^sub>3 xa (compxE\<^sub>2 body 0 0)" and
           2: "P \<turnstile> ?\<sigma>\<^sub>2' -jvm\<rightarrow> handle P D M' xa h\<^sub>3 vs' ls\<^sub>3 pc\<^sub>2 No_ics ?frs\<^sub>2 sh\<^sub>3"
           using SCall\<^sub>1.prems M'_code M'_xtab cond nsub_RI_Jcc_pieces nsub
            by (auto simp del:split_paired_Ex)
         have "handle P D M' xa h\<^sub>3 vs' ls\<^sub>3 pc\<^sub>2 No_ics ?frs\<^sub>2 sh\<^sub>3 =
               handle P C M xa h\<^sub>3 (rev pvs @ vs) ls\<^sub>2 ?pc\<^sub>2 ics frs sh\<^sub>3"
           using pc\<^sub>2 M'_in_D nclinit' by(auto simp add:handle_def)
         then show "?err" using pc\<^sub>2 jvm_trans[OF 1 2] nclinit by(auto intro:exI[where x="?pc\<^sub>2"])
       qed
     qed
   qed
 next
   case Block\<^sub>1 then show ?case using nsub_RI_Jcc_pieces by auto
 next
   case (Seq\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 w h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e\<^sub>2 e\<^sub>2' h\<^sub>2 ls\<^sub>2 sh\<^sub>2)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs,ls\<^sub>1,C,M,?pc\<^sub>1+1,ics)#frs,sh\<^sub>1)"
   let ?I = "I - pcs (compxE\<^sub>2 e\<^sub>2 (Suc ?pc\<^sub>1) (length vs))"
   have Isub: "{pc..<pc + length (compE\<^sub>2 e\<^sub>1)} \<subseteq> ?I" using Seq\<^sub>1.prems by clarsimp
   have IH: "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (Val w) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics w xa vs frs ?I" by fact
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h\<^sub>1,(w#vs,ls\<^sub>1,C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
     using Seq\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1" using Seq\<^sub>1 by auto
   finally have eval\<^sub>1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1".
   let ?pc\<^sub>2 = "?pc\<^sub>1 + 1 + length(compE\<^sub>2 e\<^sub>2)"
   let ?I' = "I - pcs(compxE\<^sub>2 e\<^sub>1 pc (size vs))"
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e\<^sub>2' h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M (?pc\<^sub>1+1) ics v xa vs frs
                      ?I'" by fact
   have Isub2: "{Suc (pc + length (compE\<^sub>2 e\<^sub>1))..<Suc (pc + length (compE\<^sub>2 e\<^sub>1) + length (compE\<^sub>2 e\<^sub>2))}
      \<subseteq> ?I'" using Seq\<^sub>1.prems by clarsimp
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note eval\<^sub>1
       also have "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,?pc\<^sub>2,ics)#frs,sh\<^sub>2)"
         using val Seq\<^sub>1.prems nsub_RI_Jcc_pieces IH\<^sub>2 Isub2 by auto
       finally show ?trans by(simp add:add.assoc)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> ?err")
     proof
       assume throw: ?throw
       then obtain pc\<^sub>2 vs' where
         pc\<^sub>2: "?pc\<^sub>1+1 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>2 \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 e\<^sub>2 (?pc\<^sub>1+1) (size vs))" and
         eval\<^sub>2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (vs'@vs) ls\<^sub>2 pc\<^sub>2 ics frs sh\<^sub>2"
         using IH\<^sub>2 Seq\<^sub>1.prems nsub_RI_Jcc_pieces Isub2 by auto
       show "?err" using pc\<^sub>2 jvm_trans[OF eval\<^sub>1 eval\<^sub>2] by(auto intro: exI[where x=pc\<^sub>2])
     qed
   qed
 next
   case (SeqThrow\<^sub>1 e\<^sub>0 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 e h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e\<^sub>1)
   let ?I = "I - pcs (compxE\<^sub>2 e\<^sub>1 (Suc (pc + length (compE\<^sub>2 e\<^sub>0))) (length vs))"
   obtain a' where throw: "throw e = Throw a'" using eval\<^sub>1_final[OF SeqThrow\<^sub>1.hyps(1)] by clarsimp
   have Isub: "{pc..<pc + length (compE\<^sub>2 e\<^sub>0)} \<subseteq> ?I" using SeqThrow\<^sub>1.prems by clarsimp
   have "PROP ?P e\<^sub>0 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (throw e) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics v a' vs frs ?I" by fact
   then show ?case using SeqThrow\<^sub>1.prems throw nsub_RI_Jcc_pieces Isub by auto
 next
   case (CondT\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e\<^sub>1 e' h\<^sub>2 ls\<^sub>2 sh\<^sub>2 e\<^sub>2)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs,ls\<^sub>1,C,M,?pc\<^sub>1+1,ics)#frs,sh\<^sub>1)"
   let ?d = "size vs"
   let ?xt\<^sub>1 = "compxE\<^sub>2 e\<^sub>1 (pc+size(compE\<^sub>2 e)+1) ?d"
   let ?xt\<^sub>2 = "compxE\<^sub>2 e\<^sub>2 (pc+size(compE\<^sub>2 e)+size(compE\<^sub>2 e\<^sub>1)+2) ?d"
   let ?I = "I - (pcs ?xt\<^sub>1 \<union> pcs ?xt\<^sub>2)"
   have Isub: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> ?I" using CondT\<^sub>1.prems by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 true h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Bool True) xa vs frs ?I" by fact
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h\<^sub>1,(Bool(True)#vs,ls\<^sub>1,C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
     using CondT\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub by(auto simp: Int_Un_distrib)
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1" using CondT\<^sub>1 by auto
   finally have eval\<^sub>1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1".
   let ?pc\<^sub>1' = "?pc\<^sub>1 + 1 + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>2' = "?pc\<^sub>1' + 1 + length(compE\<^sub>2 e\<^sub>2)"
   let ?I' = "I - pcs(compxE\<^sub>2 e pc ?d) - pcs(compxE\<^sub>2 e\<^sub>2 (?pc\<^sub>1'+1) ?d)"
   have IH2: "PROP ?P e\<^sub>1 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e' h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M (?pc\<^sub>1+1) ics v xa vs frs ?I'" by fact
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note eval\<^sub>1
       also have "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,?pc\<^sub>1',ics)#frs,sh\<^sub>2)"
         using val CondT\<^sub>1.prems nsub_RI_Jcc_pieces IH2 by(fastforce simp:Int_Un_distrib)
       also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,?pc\<^sub>2',ics)#frs,sh\<^sub>2)"
         using CondT\<^sub>1 nsub_RI_Jcc_pieces by(auto simp:add.assoc)
       finally show ?trans by(simp add:add.assoc)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> ?err")
     proof
       assume throw: ?throw
       moreover
       note IH2
       ultimately obtain pc\<^sub>2 vs' where
         pc\<^sub>2: "?pc\<^sub>1+1 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>1' \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 e\<^sub>1 (?pc\<^sub>1+1) (size vs))" and
         eval\<^sub>2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (vs'@vs) ls\<^sub>2 pc\<^sub>2 ics frs sh\<^sub>2"
         using CondT\<^sub>1.prems nsub_RI_Jcc_pieces by (fastforce simp:Int_Un_distrib)
       show "?err" using pc\<^sub>2 jvm_trans[OF eval\<^sub>1 eval\<^sub>2] by(auto intro: exI[where x=pc\<^sub>2])
     qed
   qed
 next
   case (CondF\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e\<^sub>2 e' h\<^sub>2 ls\<^sub>2 sh\<^sub>2 e\<^sub>1)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?pc\<^sub>2 = "?pc\<^sub>1 + 1 + length(compE\<^sub>2 e\<^sub>1)+ 1"
   let ?pc\<^sub>2' = "?pc\<^sub>2 + length(compE\<^sub>2 e\<^sub>2)"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs,ls\<^sub>1,C,M,?pc\<^sub>2,ics)#frs,sh\<^sub>1)"
   let ?d = "size vs"
   let ?xt\<^sub>1 = "compxE\<^sub>2 e\<^sub>1 (pc+size(compE\<^sub>2 e)+1) ?d"
   let ?xt\<^sub>2 = "compxE\<^sub>2 e\<^sub>2 (pc+size(compE\<^sub>2 e)+size(compE\<^sub>2 e\<^sub>1)+2) ?d"
   let ?I = "I - (pcs ?xt\<^sub>1 \<union> pcs ?xt\<^sub>2)"
   let ?I' = "I - pcs(compxE\<^sub>2 e pc ?d) - pcs(compxE\<^sub>2 e\<^sub>1 (?pc\<^sub>1+1) ?d)"
   have pcs: "pcs(compxE\<^sub>2 e pc ?d) \<inter> pcs(?xt\<^sub>1 @ ?xt\<^sub>2) = {}"
     using CondF\<^sub>1.prems by (simp add:Int_Un_distrib)
   have Isub: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> ?I" using CondF\<^sub>1.prems by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 false h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Bool False) xa vs frs ?I" by fact
   have IH2: "PROP ?P e\<^sub>2 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e' h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M ?pc\<^sub>2 ics v xa vs frs ?I'" by fact
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h\<^sub>1,(Bool(False)#vs,ls\<^sub>1,C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
     using CondF\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub pcs by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1" using CondF\<^sub>1 by auto
   finally have eval\<^sub>1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1".
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note eval\<^sub>1
       also have "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,?pc\<^sub>2',ics)#frs,sh\<^sub>2)"
         using val CondF\<^sub>1.prems nsub_RI_Jcc_pieces IH2 by(fastforce simp:Int_Un_distrib)
       finally show ?trans by(simp add:add.assoc)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> ?err")
     proof
       let ?I' = "I - pcs(compxE\<^sub>2 e pc ?d) - pcs(compxE\<^sub>2 e\<^sub>1 (?pc\<^sub>1+1) ?d)"
       assume throw: ?throw
       then obtain pc\<^sub>2 vs' where
         pc\<^sub>2: "?pc\<^sub>2 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>2' \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 e\<^sub>2 ?pc\<^sub>2 ?d)" and
         eval\<^sub>2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (vs'@vs) ls\<^sub>2 pc\<^sub>2 ics frs sh\<^sub>2"
         using CondF\<^sub>1.prems nsub_RI_Jcc_pieces IH2 by(fastforce simp:Int_Un_distrib)
       show "?err" using pc\<^sub>2 jvm_trans[OF eval\<^sub>1 eval\<^sub>2] by(auto intro: exI[where x=pc\<^sub>2])
     qed
   qed
 next
   case (CondThrow\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 f h\<^sub>1 ls\<^sub>1 sh\<^sub>1 e\<^sub>1 e\<^sub>2)
   let ?d = "size vs"
   let ?xt\<^sub>1 = "compxE\<^sub>2 e\<^sub>1 (pc+size(compE\<^sub>2 e)+1) ?d"
   let ?xt\<^sub>2 = "compxE\<^sub>2 e\<^sub>2 (pc+size(compE\<^sub>2 e)+size(compE\<^sub>2 e\<^sub>1)+2) ?d"
   let ?I = "I - (pcs ?xt\<^sub>1 \<union> pcs ?xt\<^sub>2)"
   have Isub: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> ?I" using CondThrow\<^sub>1.prems by clarsimp
   have "pcs(compxE\<^sub>2 e pc ?d) \<inter> pcs(?xt\<^sub>1 @ ?xt\<^sub>2) = {}"
     using CondThrow\<^sub>1.prems by (simp add:Int_Un_distrib)
   moreover have "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (throw f) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics v xa vs frs ?I" by fact
   ultimately show ?case using CondThrow\<^sub>1.prems nsub_RI_Jcc_pieces Isub by auto
 next
   case (WhileF\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 c)
   let ?pc = "pc + length(compE\<^sub>2 e)"
   let ?pc' = "?pc + length(compE\<^sub>2 c) + 3"
   have Isub: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> I - pcs (compxE\<^sub>2 c (Suc (pc + length (compE\<^sub>2 e))) (length vs))"
     using WhileF\<^sub>1.prems by clarsimp
   have Isub2: "{Suc (pc + length (compE\<^sub>2 e))..<Suc (pc + length (compE\<^sub>2 e) + length (compE\<^sub>2 c))}
      \<subseteq> I - pcs (compxE\<^sub>2 e pc (length vs))" using WhileF\<^sub>1.prems by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 false h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Bool False) xa vs frs
     (I - pcs (compxE\<^sub>2 c (Suc (pc + length (compE\<^sub>2 e))) (length vs)))" by fact
   have "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0) -jvm\<rightarrow>
             (None,h\<^sub>1,(Bool False#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using WhileF\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(vs,ls\<^sub>1,C,M,?pc',ics)#frs,sh\<^sub>1)"
     using WhileF\<^sub>1 by (auto simp:add.assoc)
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(Unit#vs,ls\<^sub>1,C,M,?pc'+1,ics)#frs,sh\<^sub>1)"
     using WhileF\<^sub>1.prems by (auto simp:eval_nat_numeral)
   finally show ?case by (simp add:add.assoc eval_nat_numeral)
 next
   case (WhileT\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 c v\<^sub>1 h\<^sub>2 ls\<^sub>2 sh\<^sub>2 e\<^sub>3 h\<^sub>3 ls\<^sub>3 sh\<^sub>3)
   let ?pc = "pc + length(compE\<^sub>2 e)"
   let ?pc' = "?pc + length(compE\<^sub>2 c) + 1"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0)"
   let ?\<sigma>\<^sub>2 = "(None,h\<^sub>2,(vs,ls\<^sub>2,C,M,pc,ics)#frs,sh\<^sub>2)"
   have Isub: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> I - pcs (compxE\<^sub>2 c (Suc (pc + length (compE\<^sub>2 e))) (length vs))"
     using WhileT\<^sub>1.prems by clarsimp
   have Isub2: "{Suc (pc + length (compE\<^sub>2 e))..<Suc (pc + length (compE\<^sub>2 e) + length (compE\<^sub>2 c))}
      \<subseteq> I - pcs (compxE\<^sub>2 e pc (length vs))" using WhileT\<^sub>1.prems by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 true h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Bool True) xa vs frs
     (I - pcs (compxE\<^sub>2 c (Suc (pc + length (compE\<^sub>2 e))) (length vs)))" by fact
   have IH2: "PROP ?P c h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (Val v\<^sub>1) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M (Suc ?pc) ics v\<^sub>1 xa vs frs
     (I - pcs (compxE\<^sub>2 e pc (length vs)))" by fact
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h\<^sub>1,(Bool True#vs,ls\<^sub>1,C,M,?pc,ics)#frs,sh\<^sub>1)"
     using WhileT\<^sub>1.prems nsub_RI_Jcc_pieces IH Isub by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(vs,ls\<^sub>1,C,M,?pc+1,ics)#frs,sh\<^sub>1)"
     using WhileT\<^sub>1.prems by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>2,(v\<^sub>1#vs,ls\<^sub>2,C,M,?pc',ics)#frs,sh\<^sub>2)"
     using WhileT\<^sub>1.prems nsub_RI_Jcc_pieces IH2 Isub2 by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>2" using WhileT\<^sub>1.prems by auto
   finally have 1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>2".
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note 1
       also have "P \<turnstile> ?\<sigma>\<^sub>2 -jvm\<rightarrow> (None,h\<^sub>3,(v#vs,ls\<^sub>3,C,M,?pc'+3,ics)#frs,sh\<^sub>3)"
         using val WhileT\<^sub>1 by (auto simp add:add.assoc eval_nat_numeral)
       finally show ?trans by(simp add:add.assoc eval_nat_numeral)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> ?err")
     proof
       assume throw: ?throw
       moreover
       have "PROP ?P (while (e) c) h\<^sub>2 ls\<^sub>2 sh\<^sub>2 e\<^sub>3 h\<^sub>3 ls\<^sub>3 sh\<^sub>3 E C M pc ics v xa vs frs I" by fact
       ultimately obtain pc\<^sub>2 vs' where
         pc\<^sub>2: "pc \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc'+3 \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>3 xa (compxE\<^sub>2 (while (e) c) pc (size vs))" and
         2: "P \<turnstile> ?\<sigma>\<^sub>2 -jvm\<rightarrow> handle P C M xa h\<^sub>3 (vs'@vs) ls\<^sub>3 pc\<^sub>2 ics frs sh\<^sub>3"
         using WhileT\<^sub>1.prems by (auto simp:add.assoc eval_nat_numeral)
       show "?err" using pc\<^sub>2 jvm_trans[OF 1 2] by(auto intro: exI[where x=pc\<^sub>2])
     qed
   qed
 next
   case (WhileCondThrow\<^sub>1 e h ls sh e' h' ls' sh' c)
   let ?I = "I - pcs (compxE\<^sub>2 c (Suc (pc + length (compE\<^sub>2 e))) (length vs))"
   obtain a' where throw: "throw e' = Throw a'" using eval\<^sub>1_final[OF WhileCondThrow\<^sub>1.hyps(1)] by clarsimp
   have Isub: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> ?I" using WhileCondThrow\<^sub>1.prems by clarsimp
   have "PROP ?P e h ls sh (throw e') h' ls' sh' E C M pc ics v a' vs frs ?I" by fact
   then show ?case using WhileCondThrow\<^sub>1.prems throw nsub_RI_Jcc_pieces Isub by auto
 next
   case (WhileBodyThrow\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 c e' h\<^sub>2 ls\<^sub>2 sh\<^sub>2)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs,ls\<^sub>1,C,M,?pc\<^sub>1+1,ics)#frs,sh\<^sub>1)"
   let ?I = "I - pcs (compxE\<^sub>2 c (Suc (pc + length (compE\<^sub>2 e))) (length vs))"
   have Isub: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> ?I"
     using WhileBodyThrow\<^sub>1.prems by clarsimp
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 true h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Bool True) xa vs frs ?I" by fact
   then have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h\<^sub>1,(Bool(True)#vs,ls\<^sub>1,C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
     using WhileBodyThrow\<^sub>1.prems nsub_RI_Jcc_pieces Isub by auto
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1" using  WhileBodyThrow\<^sub>1 by auto
   finally have eval\<^sub>1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1".
   let ?pc\<^sub>1' = "?pc\<^sub>1 + 1 + length(compE\<^sub>2 c)"
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm by simp
   next
     show ?Err (is "?throw \<longrightarrow> ?err")
     proof
       assume throw: ?throw
       moreover
       have "PROP ?P c h\<^sub>1 ls\<^sub>1 sh\<^sub>1 (throw e') h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M (?pc\<^sub>1+1) ics v xa vs frs
                     (I - pcs (compxE\<^sub>2 e pc (size vs)))" by fact
       ultimately obtain pc\<^sub>2 vs' where
         pc\<^sub>2: "?pc\<^sub>1+1 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>1' \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 c (?pc\<^sub>1+1) (size vs))" and
         eval\<^sub>2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (vs'@vs) ls\<^sub>2 pc\<^sub>2 ics frs sh\<^sub>2"
         using WhileBodyThrow\<^sub>1.prems nsub_RI_Jcc_pieces by (fastforce simp:Int_Un_distrib)
       show "?err" using pc\<^sub>2 jvm_trans[OF eval\<^sub>1 eval\<^sub>2] by(auto intro: exI[where x=pc\<^sub>2])
     qed
   qed
 next
   case (Throw\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1)
   let ?pc = "pc + size(compE\<^sub>2 e)"
   have Isub: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> I" using Throw\<^sub>1.prems by clarsimp
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm by simp
   next
     show ?Err (is "?throw \<longrightarrow> ?err")
     proof
       assume throw:?throw
       have "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (addr a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics (Addr a) a vs frs I" by fact
       then have "P \<turnstile> (None, h\<^sub>0, (vs, ls\<^sub>0, C, M, pc, ics) # frs, sh\<^sub>0) -jvm\<rightarrow>
                  (None, h\<^sub>1, (Addr xa#vs, ls\<^sub>1, C, M, ?pc, ics) # frs, sh\<^sub>1)"
         using Throw\<^sub>1 nsub_RI_Jcc_pieces Isub throw by auto
       also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M xa h\<^sub>1 (Addr xa#vs) ls\<^sub>1 ?pc ics frs sh\<^sub>1"
         using Throw\<^sub>1.prems by(auto simp add:handle_def)
       finally show "?err" by(auto intro!: exI[where x="?pc"] exI[where x="[Addr xa]"])
     qed
   qed
 next
   case (ThrowNull\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 h\<^sub>1 ls\<^sub>1 sh\<^sub>1)
   let ?pc = "pc + size(compE\<^sub>2 e)"
   let ?xa = "addr_of_sys_xcpt NullPointer"
   have Isub: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> I" using ThrowNull\<^sub>1.prems by clarsimp
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm by simp
   next
     show ?Err (is "?throw \<longrightarrow> ?err")
     proof
       assume throw: ?throw
       have "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 null h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics Null xa vs frs I" by fact
       then have "P \<turnstile> (None, h\<^sub>0, (vs, ls\<^sub>0, C, M, pc, ics) # frs, sh\<^sub>0) -jvm\<rightarrow>
                  (None, h\<^sub>1, (Null#vs, ls\<^sub>1, C, M, ?pc, ics) # frs, sh\<^sub>1)"
         using ThrowNull\<^sub>1.prems nsub_RI_Jcc_pieces Isub by auto
       also have "P \<turnstile> \<dots> -jvm\<rightarrow>  handle P C M ?xa h\<^sub>1 (Null#vs) ls\<^sub>1 ?pc ics frs sh\<^sub>1"
         using ThrowNull\<^sub>1.prems by(auto simp add:handle_def)
       finally show "?err" using throw by(auto intro!: exI[where x="?pc"] exI[where x="[Null]"])
     qed
   qed
 next
   case (ThrowThrow\<^sub>1 e h ls sh e' h' ls' sh')
   obtain a' where throw: "throw e' = Throw a'" using eval\<^sub>1_final[OF ThrowThrow\<^sub>1.hyps(1)] by clarsimp
   have Isub: "{pc..<pc + length (compE\<^sub>2 e)} \<subseteq> I" using ThrowThrow\<^sub>1.prems by clarsimp
   have "PROP ?P e h ls sh (throw e') h' ls' sh' E C M pc ics v a' vs frs I" by fact
   then show ?case using ThrowThrow\<^sub>1.prems throw nsub_RI_Jcc_pieces Isub by auto
 next
   case (Try\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 v\<^sub>1 h\<^sub>1 ls\<^sub>1 sh\<^sub>1 Ci i e\<^sub>2)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>1' = "?pc\<^sub>1 + 2 + length(compE\<^sub>2 e\<^sub>2)"
   have "{pc..<pc+size(compE\<^sub>2 (try e\<^sub>1 catch(Ci i) e\<^sub>2))} \<subseteq> I" using Try\<^sub>1.prems by simp
   also have "P,C,M \<rhd> compxE\<^sub>2 (try e\<^sub>1 catch(Ci i) e\<^sub>2) pc (size vs) / I,size vs"
     using Try\<^sub>1.prems by simp
   ultimately have "P,C,M \<rhd> compxE\<^sub>2 e\<^sub>1 pc (size vs) / {pc..<pc + length (compE\<^sub>2 e\<^sub>1)},size vs"
     by(rule beforex_try)
   hence "P \<turnstile> (None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0) -jvm\<rightarrow>
              (None,h\<^sub>1,(v\<^sub>1#vs,ls\<^sub>1,C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
     using Try\<^sub>1 nsub_RI_Jcc_pieces by auto blast
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h\<^sub>1,(v\<^sub>1#vs,ls\<^sub>1,C,M,?pc\<^sub>1',ics)#frs,sh\<^sub>1)"
     using Try\<^sub>1.prems by auto
   finally show ?case by (auto simp:add.assoc)
 next
   case (TryCatch\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 D fs Ci i e\<^sub>2 e\<^sub>2' h\<^sub>2 ls\<^sub>2 sh\<^sub>2)
   let ?e = "try e\<^sub>1 catch(Ci i) e\<^sub>2"
   let ?xt = "compxE\<^sub>2 ?e pc (size vs)"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0)"
   let ?ls\<^sub>1 = "ls\<^sub>1[i := Addr a]"
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?pc\<^sub>1' = "?pc\<^sub>1 + 2"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(vs,?ls\<^sub>1,C,M, ?pc\<^sub>1',ics) # frs,sh\<^sub>1)"
   have I: "{pc..<pc + length (compE\<^sub>2 (try e\<^sub>1 catch(Ci i) e\<^sub>2))} \<subseteq> I"
    and beforex: "P,C,M \<rhd> ?xt/I,size vs" using TryCatch\<^sub>1.prems by simp+
   have "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h\<^sub>1,((Addr a)#vs,ls\<^sub>1,C,M, ?pc\<^sub>1+1,ics) # frs,sh\<^sub>1)"
   proof -
     have ics: "ics = No_ics" using TryCatch\<^sub>1.prems by auto
     have "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (Throw a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics v a vs frs {pc..<pc + length (compE\<^sub>2 e\<^sub>1)}"
       by fact
     moreover have "P,C,M \<rhd> compxE\<^sub>2 e\<^sub>1 pc (size vs)/{pc..<?pc\<^sub>1},size vs"
       using beforex I pcs_subset by(force elim!: beforex_appendD1)
     ultimately have
       "\<exists>pc\<^sub>1. pc \<le> pc\<^sub>1 \<and> pc\<^sub>1 < ?pc\<^sub>1 \<and>
              \<not> caught P pc\<^sub>1 h\<^sub>1 a (compxE\<^sub>2 e\<^sub>1 pc (size vs)) \<and>
              (\<exists>vs'. P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> handle P C M a h\<^sub>1 (vs'@vs) ls\<^sub>1 pc\<^sub>1 ics frs sh\<^sub>1)"
       using  TryCatch\<^sub>1.prems nsub_RI_Jcc_pieces by auto
     then obtain pc\<^sub>1 vs' where
       pc\<^sub>1_in_e\<^sub>1: "pc \<le> pc\<^sub>1" "pc\<^sub>1 < ?pc\<^sub>1" and
       pc\<^sub>1_not_caught: "\<not> caught P pc\<^sub>1 h\<^sub>1 a (compxE\<^sub>2 e\<^sub>1 pc (size vs))" and
       0: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> handle P C M a h\<^sub>1 (vs'@vs) ls\<^sub>1 pc\<^sub>1 ics frs sh\<^sub>1" by iprover
     from beforex obtain xt\<^sub>0 xt\<^sub>1
       where ex_tab: "ex_table_of P C M = xt\<^sub>0 @ ?xt @ xt\<^sub>1"
       and disj: "pcs xt\<^sub>0 \<inter> I = {}" by(auto simp:beforex_def)
     have hp: "h\<^sub>1 a = Some (D, fs)" "P\<^sub>1 \<turnstile> D \<preceq>\<^sup>* Ci" by fact+
     have "pc\<^sub>1 \<notin> pcs xt\<^sub>0" using pc\<^sub>1_in_e\<^sub>1 I disj by auto
     with pc\<^sub>1_in_e\<^sub>1 pc\<^sub>1_not_caught hp
     show ?thesis using ex_tab 0 ics by(simp add:handle_def matches_ex_entry_def)
   qed
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1" using TryCatch\<^sub>1 by auto
   finally have 1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1" .
   let ?pc\<^sub>2 = "?pc\<^sub>1' + length(compE\<^sub>2 e\<^sub>2)"
   let ?I\<^sub>2 = "{?pc\<^sub>1' ..< ?pc\<^sub>2}"
   have "P,C,M \<rhd> compxE\<^sub>2 ?e pc (size vs) / I,size vs" by fact
   hence beforex\<^sub>2: "P,C,M \<rhd> compxE\<^sub>2 e\<^sub>2 ?pc\<^sub>1' (size vs) / ?I\<^sub>2, size vs"
     using I pcs_subset[of _ ?pc\<^sub>1'] by(auto elim!:beforex_appendD2)
   have IH\<^sub>2: "PROP ?P e\<^sub>2 h\<^sub>1 ?ls\<^sub>1 sh\<^sub>1 e\<^sub>2' h\<^sub>2 ls\<^sub>2 sh\<^sub>2 E C M ?pc\<^sub>1' ics v xa vs frs ?I\<^sub>2" by fact
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note 1 also have "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> (None,h\<^sub>2,(v#vs,ls\<^sub>2,C,M,?pc\<^sub>2,ics)#frs,sh\<^sub>2)"
         using val beforex\<^sub>2 IH\<^sub>2 TryCatch\<^sub>1.prems nsub_RI_Jcc_pieces by auto
       finally show ?trans by(simp add:add.assoc)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> ?err")
     proof
       assume throw: ?throw
       then obtain pc\<^sub>2 vs' where
         pc\<^sub>2: "?pc\<^sub>1+2 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>2 \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxE\<^sub>2 e\<^sub>2 ?pc\<^sub>1' (size vs))" and
         2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (vs'@vs) ls\<^sub>2 pc\<^sub>2 ics frs sh\<^sub>2"
         using IH\<^sub>2 beforex\<^sub>2 TryCatch\<^sub>1.prems nsub_RI_Jcc_pieces by auto
       show ?err using pc\<^sub>2 jvm_trans[OF 1 2]
        by (simp add:match_ex_entry) (auto intro: exI[where x=pc\<^sub>2])
     qed
   qed
 next
   case (TryThrow\<^sub>1 e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 D fs Ci i e\<^sub>2)
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0)"
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e\<^sub>1)"
   let ?e = "try e\<^sub>1 catch(Ci i) e\<^sub>2"
   let ?xt = "compxE\<^sub>2 ?e pc (size vs)"
   have I: "{pc..<pc + length (compE\<^sub>2 (try e\<^sub>1 catch(Ci i) e\<^sub>2))} \<subseteq> I"
    and beforex: "P,C,M \<rhd> ?xt/I,size vs" using TryThrow\<^sub>1.prems by simp+
   have "PROP ?P e\<^sub>1 h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (Throw a) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 E C M pc ics v a vs frs 
    {pc..<pc + length (compE\<^sub>2 e\<^sub>1)}" by fact
   moreover have "P,C,M \<rhd> compxE\<^sub>2 e\<^sub>1 pc (size vs)/{pc..<?pc\<^sub>1},size vs"
     using beforex I pcs_subset by(force elim!: beforex_appendD1)
     ultimately have
       "\<exists>pc\<^sub>1. pc \<le> pc\<^sub>1 \<and> pc\<^sub>1 < ?pc\<^sub>1 \<and>
              \<not> caught P pc\<^sub>1 h\<^sub>1 a (compxE\<^sub>2 e\<^sub>1 pc (size vs)) \<and>
              (\<exists>vs'. P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> handle P C M a h\<^sub>1 (vs'@vs) ls\<^sub>1 pc\<^sub>1 ics frs sh\<^sub>1)"
       using TryThrow\<^sub>1.prems nsub_RI_Jcc_pieces by auto
     then obtain pc\<^sub>1 vs' where
       pc\<^sub>1_in_e\<^sub>1: "pc \<le> pc\<^sub>1" "pc\<^sub>1 < ?pc\<^sub>1" and
       pc\<^sub>1_not_caught: "\<not> caught P pc\<^sub>1 h\<^sub>1 a (compxE\<^sub>2 e\<^sub>1 pc (size vs))" and
       0: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> handle P C M a h\<^sub>1 (vs'@vs) ls\<^sub>1 pc\<^sub>1 ics frs sh\<^sub>1" by iprover
   show ?case (is "?N \<and> (?eq \<longrightarrow> ?err)")
   proof
     show ?N by simp
   next
     { assume ?eq
       with TryThrow\<^sub>1 pc\<^sub>1_in_e\<^sub>1 pc\<^sub>1_not_caught 0
       have "?err" by (simp add:match_ex_entry) auto
     }
     thus "?eq \<longrightarrow> ?err" by iprover
   qed
 next
   case Nil\<^sub>1 thus ?case by simp
 next
   case (Cons\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 v h\<^sub>1 ls\<^sub>1 sh\<^sub>1 es fs h\<^sub>2 ls\<^sub>2 sh\<^sub>2)
   let ?pc\<^sub>1 = "pc + length(compE\<^sub>2 e)"
   let ?\<sigma>\<^sub>0 = "(None,h\<^sub>0,(vs,ls\<^sub>0,C,M,pc,ics)#frs,sh\<^sub>0)"
   let ?\<sigma>\<^sub>1 = "(None,h\<^sub>1,(v#vs,ls\<^sub>1,C,M,?pc\<^sub>1,ics)#frs,sh\<^sub>1)"
   have IH: "PROP ?P e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 (Val v) h\<^sub>1 ls\<^sub>1 sh\<^sub>1 [] C M pc ics v xa vs frs
     (I - pcs (compxEs\<^sub>2 es ?pc\<^sub>1 (Suc (length vs))))" by fact
   then have 1: "P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1" using Jcc_pieces_Cons[OF _ Cons\<^sub>1.prems(1-5)] by auto
   let ?pc\<^sub>2 = "?pc\<^sub>1 + length(compEs\<^sub>2 es)"
   have IHs: "PROP ?Ps es h\<^sub>1 ls\<^sub>1 sh\<^sub>1 fs h\<^sub>2 ls\<^sub>2 sh\<^sub>2 C M ?pc\<^sub>1 ics (tl ws) xa es' (v#vs) frs
     (I - pcs (compxE\<^sub>2 e pc (length vs)))" by fact
   show ?case (is "?Norm \<and> ?Err")
   proof
     show ?Norm (is "?val \<longrightarrow> ?trans")
     proof
       assume val: ?val
       note 1
       also have "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> (None,h\<^sub>2,(rev(ws) @ vs,ls\<^sub>2,C,M,?pc\<^sub>2,ics)#frs,sh\<^sub>2)"
         using val IHs Cons\<^sub>1.prems by fastforce
       finally show ?trans by(simp add:add.assoc)
     qed
   next
     show ?Err (is "?throw \<longrightarrow> (\<exists>pc\<^sub>2. ?H pc\<^sub>2)")
     proof
       assume throw: ?throw
       then obtain pc\<^sub>2 vs' where
         pc\<^sub>2: "?pc\<^sub>1 \<le> pc\<^sub>2 \<and> pc\<^sub>2 < ?pc\<^sub>2 \<and>
               \<not> caught P pc\<^sub>2 h\<^sub>2 xa (compxEs\<^sub>2 es ?pc\<^sub>1 (size vs + 1))" and
         2: "P \<turnstile> ?\<sigma>\<^sub>1 -jvm\<rightarrow> handle P C M xa h\<^sub>2 (vs'@v#vs) ls\<^sub>2 pc\<^sub>2 ics frs sh\<^sub>2"
         using IHs Cons\<^sub>1.prems by(fastforce simp:Cons_eq_append_conv neq_Nil_conv)
       have "?H pc\<^sub>2" using Cons\<^sub>1.prems pc\<^sub>2 jvm_trans[OF 1 2] by(auto intro!: exI[where x="vs'@[v]"])
       thus "\<exists>pc\<^sub>2. ?H pc\<^sub>2" by iprover
     qed
   qed
 next
   case (ConsThrow\<^sub>1 e h\<^sub>0 ls\<^sub>0 sh\<^sub>0 a h\<^sub>1 ls\<^sub>1 sh\<^sub>1 es)
   then show ?case using Jcc_pieces_Cons[OF _ ConsThrow\<^sub>1.prems(1-5)]
     by (fastforce simp:Cons_eq_append_conv)
 next
   case InitFinal\<^sub>1 then show ?case using eval\<^sub>1_final_same[OF InitFinal\<^sub>1.hyps(1)] by clarsimp
 next
   case (InitNone\<^sub>1 sh C\<^sub>0 C' Cs e h l e' h' l' sh')
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa
      (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)"
     using InitNone\<^sub>1.prems(1) by clarsimp
   let ?sh = "(sh(C\<^sub>0 \<mapsto> (sblank P\<^sub>1 C\<^sub>0, Prepared)))"
   obtain ics: "ics_of(hd frs') = Calling C\<^sub>0 Cs"
      and frs\<^sub>1: "frs' \<noteq> Nil" using pcs by clarsimp
   then have 1: "P \<turnstile> (None,h,frs',sh) -jvm\<rightarrow> (None,h,frs',?sh)"
     using InitNone\<^sub>1 jvm_InitNone[where P = P] by(cases frs', simp+)
   show ?case (is "(?e1 \<longrightarrow> ?jvm1) \<and> (?e2 \<longrightarrow> ?err)")
   proof(rule conjI)
     { assume val: ?e1
       note 1
       also have "P \<turnstile> (None,h,frs',?sh) -jvm\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh')"
         using InitNone\<^sub>1.hyps(3)[of E] Jcc_pieces_InitNone[OF assms(1) pcs] InitNone\<^sub>1.prems val
          by clarsimp
       finally have ?jvm1 using pcs by simp
     }
     thus "?e1 \<longrightarrow> ?jvm1" by simp
   next
     { assume throw: ?e2
       note 1
       also obtain vs' where "P \<turnstile> (None,h,frs',?sh)
                      -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'"
         using InitNone\<^sub>1.hyps(3)[of E] Jcc_pieces_InitNone[OF assms(1) pcs] throw
          by clarsimp presburger
       finally have ?err using pcs by auto
     }
     thus "?e2 \<longrightarrow> ?err" by simp
   qed
 next
   case (InitDone\<^sub>1 sh C\<^sub>0 sfs C' Cs e h l e' h' l' sh')
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa
      (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)"
     using InitDone\<^sub>1.prems(1) by clarsimp
   let ?frs' = "(calling_to_scalled (hd frs'))#(tl frs')"
   have IH: "PROP ?P (INIT C' (Cs,True) \<leftarrow> e) h l sh e' h' l' sh' E C M pc ics v xa vs frs I"
     by fact
   obtain ics: "ics_of(hd frs') = Calling C\<^sub>0 Cs"
      and frs\<^sub>1: "frs' \<noteq> Nil" using pcs by clarsimp
   then have 1: "P \<turnstile> (None,h,frs',sh) -jvm\<rightarrow> (None,h,?frs',sh)"
     using InitDone\<^sub>1 jvm_InitDP[where P = P] by(cases frs', simp+)
   show ?case (is "(?e1 \<longrightarrow> ?jvm1) \<and> (?e2 \<longrightarrow> ?err)")
   proof(rule conjI)
     { assume val: ?e1
       note 1
       also have "P \<turnstile> (None,h,?frs',sh) -jvm\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh')"
         using IH Jcc_pieces_InitDP[OF assms(1) pcs] InitDone\<^sub>1.prems val by clarsimp
       finally have ?jvm1 using pcs by simp
     }
     thus "?e1 \<longrightarrow> ?jvm1" by simp
   next
     { assume throw: ?e2
       note 1
       also obtain vs' where "P \<turnstile> (None,h,?frs',sh)
                      -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'"
         using IH Jcc_pieces_InitDP[OF assms(1) pcs] InitDone\<^sub>1.prems throw by clarsimp
       finally have ?err using pcs by auto
     }
     thus "?e2 \<longrightarrow> ?err" by simp
   qed
 next
   case (InitProcessing\<^sub>1 sh C\<^sub>0 sfs C' Cs e h l e' h' l' sh')
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa
      (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)"
     using InitProcessing\<^sub>1.prems(1) by clarsimp
   let ?frs' = "(calling_to_scalled (hd frs'))#(tl frs')"
   have IH: "PROP ?P (INIT C' (Cs,True) \<leftarrow> e) h l sh e' h' l' sh' E C M pc ics v xa vs frs I"
     by fact
   obtain ics: "ics_of(hd frs') = Calling C\<^sub>0 Cs"
      and frs\<^sub>1: "frs' \<noteq> Nil" using pcs by clarsimp
   then have 1: "P \<turnstile> (None,h,frs',sh) -jvm\<rightarrow> (None,h,?frs',sh)"
     using InitProcessing\<^sub>1 jvm_InitDP[where P = P] by(cases frs', simp+)
   show ?case (is "(?e1 \<longrightarrow> ?jvm1) \<and> (?e2 \<longrightarrow> ?err)")
   proof(rule conjI)
     { assume val: ?e1
       note 1
       also have "P \<turnstile> (None,h,?frs',sh) -jvm\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh')"
         using IH Jcc_pieces_InitDP[OF assms(1) pcs] InitProcessing\<^sub>1.prems val by clarsimp
       finally have ?jvm1 using pcs by simp
     }
     thus "?e1 \<longrightarrow> ?jvm1" by simp
   next
     { assume throw: ?e2
       note 1
       also obtain vs' where "P \<turnstile> (None,h,?frs',sh)
                      -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'"
         using IH Jcc_pieces_InitDP[OF assms(1) pcs] InitProcessing\<^sub>1.prems throw by clarsimp
       finally have ?err using pcs by auto
     }
     thus "?e2 \<longrightarrow> ?err" by simp
   qed
 next
   case (InitError\<^sub>1 sh C\<^sub>0 sfs Cs e h l e' h' l' sh' C')
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa
      (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)"
     using InitError\<^sub>1.prems(1) by clarsimp
   let ?e\<^sub>0 = "THROW NoClassDefFoundError"
   let ?frs' = "(calling_to_sthrowing (hd frs') (addr_of_sys_xcpt NoClassDefFoundError))#(tl frs')"
   have IH: "PROP ?P (RI (C\<^sub>0,?e\<^sub>0) ; Cs \<leftarrow> e) h l sh e' h' l' sh' E C M pc ics v xa vs frs I" by fact
   obtain ics: "ics_of(hd frs') = Calling C\<^sub>0 Cs"
      and frs\<^sub>1: "frs' \<noteq> Nil"
      and tl: "tl frs' = frs" using pcs by clarsimp
   then have 1: "P \<turnstile> (None,h,frs',sh) -jvm\<rightarrow> (None,h,?frs',sh)"
   proof(cases frs')
     case (Cons a list)
     obtain vs' l' C' M' pc' ics' where a: "a = (vs',l',C',M',pc',ics')" by(cases a)
     then have "ics' = Calling C\<^sub>0 Cs" using Cons ics by simp
     then show ?thesis
      using Cons a IH InitError\<^sub>1.prems jvm_InitError[where P = P] InitError\<^sub>1.hyps(1) by simp
   qed(simp)
   show ?case (is "(?e1 \<longrightarrow> ?jvm1) \<and> (?e2 \<longrightarrow> ?err)")
   proof(rule conjI)
     { assume val: ?e1
       then have False using val rinit\<^sub>1_throw[OF InitError\<^sub>1.hyps(2)] by blast
       then have ?jvm1 using pcs by simp
     }
     thus "?e1 \<longrightarrow> ?jvm1" by simp
   next
     { assume throw: ?e2
       let ?frs = "(calling_to_throwing (hd frs') (addr_of_sys_xcpt NoClassDefFoundError))#(tl frs')"
       have exec: "exec (P, (None,h,?frs,sh)) = Some (None,h,?frs',sh)"
         using exec_ErrorThrowing[where sh=sh, OF InitError\<^sub>1.hyps(1)] ics by(cases "hd frs'", simp)
       obtain vs' where 2: "P \<turnstile> (None,h,?frs,sh) -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'"
         using IH Jcc_pieces_InitError[OF assms(1) pcs InitError\<^sub>1.hyps(1)] throw by clarsimp
       have neq: "(None, h, ?frs, sh) \<noteq> handle P C M xa h' (vs' @ vs) l pc ics frs sh'"
         using tl ics by(cases "hd frs'", simp add: handle_frs_tl_neq)
 
       note 1
       also have "P \<turnstile> (None,h,?frs',sh) -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'"
         using exec_1_exec_all_conf[OF exec 2] neq by simp
       finally have ?err using pcs by auto
     }
     thus "?e2 \<longrightarrow> ?err" by simp
   qed
 next
   case (InitObject\<^sub>1 sh C\<^sub>0 sfs sh' C' Cs e h l e' h' l' sh'')
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l'
     (sh(C\<^sub>0 \<mapsto> (sfs, Processing))) v xa (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)"
     using InitObject\<^sub>1.prems(1) by clarsimp
   let ?frs' = "(calling_to_called (hd frs'))#(tl frs')"
   have IH: "PROP ?P (INIT C' (C\<^sub>0#Cs,True) \<leftarrow> e) h l sh' e' h' l' sh'' E C M pc ics v xa vs frs I"
     by fact
   obtain ics: "ics_of(hd frs') = Calling C\<^sub>0 Cs"
      and frs\<^sub>1: "frs' \<noteq> Nil" using pcs by clarsimp
   then have 1: "P \<turnstile> (None,h,frs',sh) -jvm\<rightarrow> (None,h,?frs',sh')"
   proof(cases frs')
     case (Cons a list)
     obtain vs' l' C' M' pc' ics' where a: "a = (vs',l',C',M',pc',ics')" by(cases a)
     then have "ics' = Calling C\<^sub>0 Cs" using Cons ics by simp
     then show ?thesis
      using Cons Nil a IH InitObject\<^sub>1 jvm_InitObj[where P = P] by simp
   qed(simp)
   show ?case (is "(?e1 \<longrightarrow> ?jvm1) \<and> (?e2 \<longrightarrow> ?err)")
   proof(rule conjI)
     { assume val: ?e1
       note 1
       also have "P \<turnstile> (None,h,?frs',sh') -jvm\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh'')"
         using IH Jcc_pieces_InitObj[OF assms(1) pcs] InitObject\<^sub>1 val by simp
       finally have ?jvm1 using pcs by simp
     }
     thus "?e1 \<longrightarrow> ?jvm1" by simp
   next
     { assume throw: ?e2
       note 1
       also obtain vs' where "P \<turnstile> (None,h,?frs',sh')
                      -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh''"
         using IH Jcc_pieces_InitObj[OF assms(1) pcs] InitObject\<^sub>1 throw by clarsimp
       finally have ?err using pcs by auto
     }
     thus "?e2 \<longrightarrow> ?err" by simp
   qed
 next
   case (InitNonObject\<^sub>1 sh C\<^sub>0 sfs D a b sh' C' Cs e h l e' h' l' sh'')
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l'
     (sh(C\<^sub>0 \<mapsto> (sfs,Processing))) v xa (INIT C' (C\<^sub>0 # Cs,False) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)"
     using InitNonObject\<^sub>1.prems(1) by clarsimp
   let ?frs' = "(calling_to_calling (hd frs') D)#(tl frs')"
   have cls1: "is_class P\<^sub>1 D" using InitNonObject\<^sub>1.hyps(2,3) class_wf wf wf_cdecl_supD by blast
   have cls_aux: "distinct (C\<^sub>0#Cs) \<and> supercls_lst P\<^sub>1 (C\<^sub>0#Cs)" using InitNonObject\<^sub>1.prems(1) by auto
   then have cls2: "D \<notin> set (C\<^sub>0 # Cs)"
   proof -
     have "distinct (D # C\<^sub>0 # Cs)"
       using InitNonObject\<^sub>1.hyps(2,3) cls_aux wf wf_supercls_distinct_app by blast
     then show "D \<notin> set (C\<^sub>0 # Cs)"
       by (metis distinct.simps(2))
   qed
   have cls3: "\<forall>C\<in>set (C\<^sub>0 # Cs). P\<^sub>1 \<turnstile> C \<preceq>\<^sup>* D" using InitNonObject\<^sub>1.hyps(2,3) cls_aux
     by (metis r_into_rtrancl rtrancl_into_rtrancl set_ConsD subcls1.subcls1I supercls_lst.simps(1))
   have IH: "PROP ?P (INIT C' (D # C\<^sub>0 # Cs,False) \<leftarrow> e) h l sh' e' h' l' sh'' E C M pc ics v xa vs frs I"
     by fact
   obtain r where cls: "class P C\<^sub>0 = \<lfloor>(D, r)\<rfloor>" using InitNonObject\<^sub>1.hyps(3)
     by (metis assms class_compP compP\<^sub>2_def)
   obtain ics: "ics_of(hd frs') = Calling C\<^sub>0 Cs"
      and frs\<^sub>1: "frs' \<noteq> Nil" using pcs by clarsimp
   then have 1: "P \<turnstile> (None,h,frs',sh) -jvm\<rightarrow> (None,h,?frs',sh')"
   proof(cases frs')
     case (Cons a list)
     obtain vs' l' C' M' pc' ics' where a: "a = (vs',l',C',M',pc',ics')" by(cases a)
     then have "ics' = Calling C\<^sub>0 Cs" using Cons ics by simp
     then show ?thesis
      using Cons a IH InitNonObject\<^sub>1 jvm_InitNonObj[OF _ _ cls] by simp
   qed(simp)
   show ?case (is "(?e1 \<longrightarrow> ?jvm1) \<and> (?e2 \<longrightarrow> ?err)")
   proof(rule conjI)
     { assume val: ?e1
       note 1
       also have "P \<turnstile> (None,h,?frs',sh') -jvm\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh'')"
         using IH Jcc_pieces_InitNonObj[OF assms(1) cls1 cls2 cls3 pcs] InitNonObject\<^sub>1 val by simp
       finally have ?jvm1 using pcs by simp
     }
     thus "?e1 \<longrightarrow> ?jvm1" by simp
   next
     { assume throw: ?e2
       note 1
       also obtain vs' where "P \<turnstile> (None,h,?frs',sh')
                      -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh''"
         using IH Jcc_pieces_InitNonObj[OF assms(1) cls1 cls2 cls3 pcs] InitNonObject\<^sub>1 throw by clarsimp
       finally have ?err using pcs by auto
     }
     thus "?e2 \<longrightarrow> ?err" by simp
   qed
 next
   case (InitRInit\<^sub>1 C\<^sub>0 Cs e h l sh e' h' l' sh' C')
   then obtain frs' err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh' v xa
      (INIT C' (C\<^sub>0 # Cs,True) \<leftarrow> e)
     = (True, frs', (None, h', (vs, l, C, M, pc, Called []) # frs, sh'), err)"
     using InitRInit\<^sub>1.prems(1) by clarsimp
   have IH: "PROP ?P (RI (C\<^sub>0,C\<^sub>0\<bullet>\<^sub>sclinit([])) ; Cs \<leftarrow> e) h l sh e' h' l' sh' E C M pc ics v xa vs frs I"
     by fact
   show ?case (is "(?e1 \<longrightarrow> ?jvm1) \<and> (?e2 \<longrightarrow> ?err)")
   proof(rule conjI)
     { assume val: ?e1
       have "P \<turnstile> (None,h,frs',sh) -jvm\<rightarrow> (None,h',(vs,l,C,M,pc,Called [])#frs,sh')"
         using IH Jcc_pieces_InitRInit[OF assms(1,2) pcs] InitRInit\<^sub>1.prems val by simp
       then have ?jvm1 using pcs by simp
     }
     thus "?e1 \<longrightarrow> ?jvm1" by simp
   next
     { assume throw: ?e2
       obtain vs' where "P \<turnstile> (None,h,frs',sh)
                      -jvm\<rightarrow> handle P C M xa h' (vs'@vs) l pc ics frs sh'"
         using IH Jcc_pieces_InitRInit[OF assms(1,2) pcs] InitRInit\<^sub>1 throw by clarsimp
       then have ?err using pcs by auto
     }
     thus "?e2 \<longrightarrow> ?err" by simp
   qed
 next
   case (RInit\<^sub>1 e h l sh v1 h' l' sh' C\<^sub>0 sfs i sh'' C' Cs e' e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1)
   let ?frs = "(vs,l,C,M,pc,Called (C\<^sub>0#Cs)) # frs"
   let ?frs' = "(vs,l,C,M,pc,Called Cs) # frs"
   have clinit: "e = C\<^sub>0\<bullet>\<^sub>sclinit([])" using RInit\<^sub>1
     by (metis Jcc_cond.simps(2) eval\<^sub>1_final_same exp.distinct(101) final_def)
   then obtain err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h\<^sub>1 l\<^sub>1 sh\<^sub>1 v xa
      (RI (C\<^sub>0,C\<^sub>0\<bullet>\<^sub>sclinit([])) ; Cs \<leftarrow> e')
     = (True, ?frs, (None, h\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\<^sub>1), err)"
     using RInit\<^sub>1.prems(1) by simp
   have shC: "\<forall>C'\<in>set Cs. \<exists>sfs. sh C' = \<lfloor>(sfs, Processing)\<rfloor>" using RInit\<^sub>1.prems(1) clinit by clarsimp
   then have shC'': "\<forall>C'\<in>set Cs. \<exists>sfs. sh'' C' = \<lfloor>(sfs, Processing)\<rfloor>"
     using clinit\<^sub>1_proc_pres[OF wf] RInit\<^sub>1.hyps(1) clinit RInit\<^sub>1.hyps(4) RInit\<^sub>1.prems(1)
       by (auto simp: fun_upd_apply)
   have loc: "l = l'" using clinit\<^sub>1_loc_pres RInit\<^sub>1.hyps(1) clinit by simp
   have IH: "PROP ?P e h l sh (Val v1) h' l' sh' E C M pc (Called Cs) v1 xa vs (tl ?frs') I" by fact
   then have IH':
    "PROP ?P (C\<^sub>0\<bullet>\<^sub>sclinit([])) h l sh (Val v1) h' l' sh' E C M pc (Called Cs) v1 xa vs (tl ?frs') I"
     using clinit by simp
   have IH2: "PROP ?P (INIT C' (Cs,True) \<leftarrow> e') h' l' sh'' e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 E C M
     pc ics v xa vs frs I" by fact
   have "P \<turnstile> (None,h,?frs,sh) -jvm\<rightarrow> (None,h,create_init_frame P C\<^sub>0 # ?frs',sh)" by(rule jvm_Called)
   also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h',?frs',sh'')"
      using IH' Jcc_pieces_RInit_clinit[OF assms(1-2) pcs,of h' l' sh'] RInit\<^sub>1.hyps(3,4) by simp
   finally have jvm1: "P \<turnstile> (None,h,?frs,sh) -jvm\<rightarrow> (None,h',?frs',sh'')" .
   show ?case (is "(?e1 \<longrightarrow> ?jvm1) \<and> (?e2 \<longrightarrow> ?err)")
   proof(rule conjI)
     { assume val: ?e1
       note jvm1
       also have "P \<turnstile> (None,h',?frs',sh'') -jvm\<rightarrow> (None,h\<^sub>1,(vs,l,C,M,pc,Called [])#frs,sh\<^sub>1)"
         using IH2 Jcc_pieces_RInit_Init[OF assms(1-2) shC'' pcs,of h'] RInit\<^sub>1.hyps(5) loc val by auto
       finally have ?jvm1 using pcs clinit by simp
     }
     thus "?e1 \<longrightarrow> ?jvm1" by simp
   next
     { assume throw: ?e2
       note jvm1
       also obtain vs' where "P \<turnstile> (None,h',?frs',sh'')
                      -jvm\<rightarrow> handle P C M xa h\<^sub>1 (vs'@vs) l pc ics frs sh\<^sub>1"
         using IH2 Jcc_pieces_RInit_Init[OF assms(1-2) shC'' pcs,of h'] RInit\<^sub>1.hyps(5) loc throw by auto
       finally have ?err using pcs clinit by auto
     }
     thus "?e2 \<longrightarrow> ?err" by simp
   qed
 next
   case (RInitInitFail\<^sub>1 e h l sh a h' l' sh' C\<^sub>0 sfs i sh'' D Cs e' e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1)
   let ?frs = "(vs,l,C,M,pc,Called (C\<^sub>0#D#Cs)) # frs"
   let ?frs' = "(vs,l,C,M,pc,Called (D#Cs)) # frs"
   let "?frsT" = "\<lambda>xa1. (vs,l,C,M,pc,Throwing (C\<^sub>0#D#Cs) xa1) # frs"
   let "?frsT'" = "\<lambda>xa1. (vs,l,C,M,pc,Throwing (D#Cs) xa1) # frs"
   obtain xa' where xa': "throw a = Throw xa'"
     by (metis RInitInitFail\<^sub>1.hyps(1) eval\<^sub>1_final exp.distinct(101) final_def)
   have e\<^sub>1: "e\<^sub>1 = Throw xa'" using xa' rinit\<^sub>1_throw RInitInitFail\<^sub>1.hyps(5) by simp
   show ?case
   proof(cases "e = C\<^sub>0\<bullet>\<^sub>sclinit([])")
     case clinit: True
     then obtain err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h\<^sub>1 l\<^sub>1 sh\<^sub>1 v xa'
        (RI (C\<^sub>0,C\<^sub>0\<bullet>\<^sub>sclinit([])) ; D # Cs \<leftarrow> e')
       = (True, ?frs, (None, h\<^sub>1, (vs, l, C, M, pc, Called []) # frs, sh\<^sub>1), err)"
       using RInitInitFail\<^sub>1.prems(1) by simp
     have loc: "l = l'" using clinit\<^sub>1_loc_pres RInitInitFail\<^sub>1.hyps(1) clinit by simp
     have IH: "PROP ?P e h l sh (throw a) h' l' sh' E C M pc (Called (D#Cs)) v xa' vs frs I"
      by fact
     then have IH':
      "PROP ?P (C\<^sub>0\<bullet>\<^sub>sclinit([])) h l sh (Throw xa') h' l' sh' E C M pc (Called (D#Cs)) v xa' vs
        frs I"  using clinit xa' by simp
     have IH2: "PROP ?P (RI (D,throw a) ; Cs \<leftarrow> e') h' l' sh'' e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 E C M
       pc ics v xa' vs frs I" by fact
     have "P \<turnstile> (None,h,?frs,sh) -jvm\<rightarrow> (None,h,create_init_frame P C\<^sub>0 # ?frs',sh)" by(rule jvm_Called)
     also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h',(vs, l, C, M, pc, Throwing (D#Cs) xa') # frs,sh'')"
       using IH' Jcc_pieces_RInit_clinit[OF assms(1-2) pcs,of h' l' sh'] RInitInitFail\<^sub>1.hyps(3,4)
         by simp
     also obtain vs'' where "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M xa' h\<^sub>1 (vs''@vs) l pc ics frs sh\<^sub>1"
       using IH2 pcs Jcc_pieces_RInit_RInit[OF assms(1) pcs] RInitInitFail\<^sub>1.hyps(3,4)
         xa' loc e\<^sub>1 xa' by clarsimp
     finally show ?thesis using pcs e\<^sub>1 clinit by auto
   next
     case throw: False
     then have eT: "e = Throw xa'" "h = h'" "l = l'" "sh = sh'" using xa' RInitInitFail\<^sub>1.prems(1)
       eval\<^sub>1_final_same[OF RInitInitFail\<^sub>1.hyps(1)] by clarsimp+
     obtain a' where "class P\<^sub>1 C\<^sub>0 = \<lfloor>a'\<rfloor>" using RInitInitFail\<^sub>1.prems by(auto simp: is_class_def)
     then obtain stk' loc' M' pc' ics' where "create_init_frame P C\<^sub>0 = (stk',loc',C\<^sub>0,M',pc',ics')"
       using create_init_frame_wf_eq[OF wf] by(cases "create_init_frame P C\<^sub>0", simp)
     then obtain rhs err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh'' v xa'
        (RI (C\<^sub>0,e) ; D#Cs \<leftarrow> e') = (True, ?frsT xa', rhs, err)"
       using RInitInitFail\<^sub>1.prems(1) eT by clarsimp
     have IH2: "PROP ?P (RI (D,throw a) ; Cs \<leftarrow> e') h' l' sh'' e\<^sub>1 h\<^sub>1 l\<^sub>1 sh\<^sub>1 E C M
       pc ics v xa' vs frs I" by fact
     have "P \<turnstile> (None,h,?frsT xa',sh') -jvm\<rightarrow> (None,h,?frsT' xa',sh'(C\<^sub>0 \<mapsto> (fst (the (sh' C\<^sub>0)), Error)))"
       by(rule jvm_Throwing)
     also obtain vs' where "P \<turnstile> ... -jvm\<rightarrow> handle P C M xa' h\<^sub>1 (vs'@vs) l pc ics frs sh\<^sub>1"
       using IH2 Jcc_pieces_RInit_RInit[OF assms(1) pcs] RInitInitFail\<^sub>1.hyps(3,4)
        eT e\<^sub>1 xa' by clarsimp
     finally show ?thesis using pcs e\<^sub>1 throw eT by auto
   qed
 next
   case (RInitFailFinal\<^sub>1 e h l sh a h' l' sh' C\<^sub>0 sfs i sh'' e'')
   let ?frs = "(vs,l,C,M,pc,Called [C\<^sub>0]) # frs"
   let ?frs' = "(vs,l,C,M,pc,Called []) # frs"
   let "?frsT" = "\<lambda>xa1. (vs,l,C,M,pc,Throwing [C\<^sub>0] xa1) # frs"
   let "?frsT'" = "\<lambda>xa1. (vs,l,C,M,pc,Throwing [] xa1) # frs"
   obtain xa' where xa': "throw a = Throw xa'"
     by (metis RInitFailFinal\<^sub>1.hyps(1) eval\<^sub>1_final exp.distinct(101) final_def)
   show ?case
   proof(cases "e = C\<^sub>0\<bullet>\<^sub>sclinit([])")
     case clinit: True
     then obtain err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh'' v xa'
        (RI (C\<^sub>0,C\<^sub>0\<bullet>\<^sub>sclinit([])) ; [] \<leftarrow> unit) = (True, ?frs, (None, h', ?frs', sh''), err)"
       using RInitFailFinal\<^sub>1.prems(1) by clarsimp
     have IH: "PROP ?P e h l sh (throw a) h' l' sh' E C M pc (Called []) v xa' vs frs I" by fact
     then have IH':
      "PROP ?P (C\<^sub>0\<bullet>\<^sub>sclinit([])) h l sh (throw a) h' l' sh' E C M pc (Called []) v xa' vs frs I"
       using clinit by simp
     have "P \<turnstile> (None,h,?frs,sh) -jvm\<rightarrow> (None,h,create_init_frame P C\<^sub>0 # ?frs',sh)"
       by(rule jvm_Called)
     also have "P \<turnstile> \<dots> -jvm\<rightarrow> (None,h',?frsT' xa',sh'')"
       using IH' Jcc_pieces_RInit_clinit[OF assms(1-2) pcs,of h' l' sh'] xa'
         RInitFailFinal\<^sub>1.hyps(3,4) by simp
     also have
        "P \<turnstile> \<dots> -jvm\<rightarrow> handle (compP compMb\<^sub>2 P\<^sub>1) C M xa' h' vs l pc No_ics frs sh''"
       using RInitFailFinal\<^sub>1.hyps(3,4) jvm_RInit_throw[where h=h' and sh=sh''] by simp
     finally show ?thesis using xa' pcs clinit by(clarsimp intro!: exI[where x="[]"])
   next
     case throw: False
     then have eT: "e = Throw xa'" "h = h'" "sh = sh'" using xa' RInitFailFinal\<^sub>1.prems(1)
       eval\<^sub>1_final_same[OF RInitFailFinal\<^sub>1.hyps(1)] by clarsimp+
     obtain a where "class P\<^sub>1 C\<^sub>0 = \<lfloor>a\<rfloor>" using RInitFailFinal\<^sub>1.prems by(auto simp: is_class_def)
     then obtain stk' loc' M' pc' ics' where "create_init_frame P C\<^sub>0 = (stk',loc',C\<^sub>0,M',pc',ics')"
       using create_init_frame_wf_eq[OF wf] by(cases "create_init_frame P C\<^sub>0", simp)
     then obtain rhs err where pcs: "Jcc_pieces P\<^sub>1 E C M h vs l pc ics frs sh I h' l' sh'' v xa'
        (RI (C\<^sub>0,e) ; [] \<leftarrow> unit) = (True, ?frsT xa', rhs, err)"
       using RInitFailFinal\<^sub>1.prems(1) eT by clarsimp
     have "P \<turnstile> (None,h,?frsT xa',sh) -jvm\<rightarrow> (None,h,?frsT' xa',sh(C\<^sub>0 \<mapsto> (fst (the (sh C\<^sub>0)), Error)))"
       by(rule jvm_Throwing)
     also have "P \<turnstile> \<dots> -jvm\<rightarrow> handle P C M xa' h' vs l pc No_ics frs sh''"
       using RInitFailFinal\<^sub>1.hyps(3,4) jvm_RInit_throw[where h=h and sh=sh''] eT by simp
     finally show ?thesis using pcs xa' by(clarsimp intro!: exI[where x="[]"])
   qed
 qed
 (*>*)
 
 (*FIXME move! *)
 lemma atLeast0AtMost[simp]: "{0::nat..n} = {..n}"
 by auto
 
 lemma atLeast0LessThan[simp]: "{0::nat..<n} = {..<n}"
 by auto
 
 fun exception :: "'a exp \<Rightarrow> addr option" where
   "exception (Throw a) = Some a"
 | "exception e = None"
 
 lemma comp\<^sub>2_correct:
 assumes wf: "wf_J\<^sub>1_prog P\<^sub>1"
     and "method": "P\<^sub>1 \<turnstile> C sees M,b:Ts\<rightarrow>T = body in C"
     and eval:   "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>body,(h,ls,sh)\<rangle> \<Rightarrow> \<langle>e',(h',ls',sh')\<rangle>"
     and nclinit: "M \<noteq> clinit"
 shows "compP\<^sub>2 P\<^sub>1 \<turnstile> (None,h,[([],ls,C,M,0,No_ics)],sh) -jvm\<rightarrow> (exception e',h',[],sh')"
 (*<*)
       (is "_ \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> ?\<sigma>\<^sub>1")
 proof -
   let ?P = "compP\<^sub>2 P\<^sub>1"
   let ?E = "case b of Static \<Rightarrow> Ts | NonStatic \<Rightarrow> Class C#Ts"
   have nsub: "\<not>sub_RI body" using sees_wf\<^sub>1_nsub_RI[OF wf method] by simp
   have code: "?P,C,M,0 \<rhd> compE\<^sub>2 body" using beforeM[OF "method"] by auto
   have xtab: "?P,C,M \<rhd> compxE\<^sub>2 body 0 (size[])/{..<size(compE\<^sub>2 body)},size[]"
     using beforexM[OF "method"] by auto
   have cond: "Jcc_cond P\<^sub>1 ?E C M [] 0 No_ics {..<size(compE\<^sub>2 body)} h sh body"
     using nsub_RI_Jcc_pieces nsub code xtab by auto
   \<comment> \<open>Distinguish if e' is a value or an exception\<close>
   { fix v assume [simp]: "e' = Val v"
     have "?P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> (None,h',[([v],ls',C,M,size(compE\<^sub>2 body),No_ics)],sh')"
       using Jcc[OF wf eval cond] nsub_RI_Jcc_pieces[OF _ nsub] by auto
     also have "?P \<turnstile> \<dots> -jvm\<rightarrow> ?\<sigma>\<^sub>1" using beforeM[OF "method"] nclinit by auto
     finally have ?thesis .
   }
   moreover
   { fix a assume [simp]: "e' = Throw a"
     obtain pc vs' where pc: "0 \<le> pc \<and> pc < size(compE\<^sub>2 body) \<and>
           \<not> caught ?P pc h' a (compxE\<^sub>2 body 0 0)"
     and 1: "?P \<turnstile> ?\<sigma>\<^sub>0 -jvm\<rightarrow> handle ?P C M a h' vs' ls' pc No_ics [] sh'"
       using Jcc[OF wf eval cond] nsub_RI_Jcc_pieces[OF _ nsub] by auto meson
     from pc have "handle ?P C M a h' vs' ls' pc No_ics [] sh' = ?\<sigma>\<^sub>1" using xtab "method" nclinit
       by(auto simp:handle_def compMb\<^sub>2_def)
     with 1 have ?thesis by simp
   } 
   ultimately show ?thesis using eval\<^sub>1_final[OF eval] by(auto simp:final_def)
 qed
 (*>*)
 
 end
diff --git a/thys/JinjaDCI/Compiler/J1.thy b/thys/JinjaDCI/Compiler/J1.thy
--- a/thys/JinjaDCI/Compiler/J1.thy
+++ b/thys/JinjaDCI/Compiler/J1.thy
@@ -1,535 +1,548 @@
 (*  Title:      JinjaDCI/Compiler/J1.thy
     Author:     Tobias Nipkow, Susannah Mansky
     Copyright   2003 Technische Universitaet Muenchen, 2019-20 UIUC
 
     Based on the Jinja theory Compiler/J1.thy by Tobias Nipkow
 *)
 
 chapter \<open> Compilation \label{cha:comp} \<close>
 
 section \<open> An Intermediate Language \<close>
 
 theory J1 imports "../J/BigStep" begin
 
 type_synonym expr\<^sub>1 = "nat exp"
 type_synonym J\<^sub>1_prog = "expr\<^sub>1 prog"
 type_synonym state\<^sub>1 = "heap \<times> (val list) \<times> sheap"
 
 definition hp\<^sub>1 :: "state\<^sub>1 \<Rightarrow> heap"
 where
   "hp\<^sub>1  \<equiv>  fst"
 definition lcl\<^sub>1 :: "state\<^sub>1 \<Rightarrow> val list"
 where
   "lcl\<^sub>1  \<equiv>  fst \<circ> snd"
 definition shp\<^sub>1 :: "state\<^sub>1 \<Rightarrow> sheap"
 where
   "shp\<^sub>1  \<equiv>  snd \<circ> snd"
 
 (*<*)
 declare hp\<^sub>1_def[simp] lcl\<^sub>1_def[simp] shp\<^sub>1_def[simp]
 (*>*)
 
 primrec
   max_vars :: "'a exp \<Rightarrow> nat"
   and max_varss :: "'a exp list \<Rightarrow> nat"
 where
   "max_vars(new C) = 0"
 | "max_vars(Cast C e) = max_vars e"
 | "max_vars(Val v) = 0"
 | "max_vars(e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2) = max (max_vars e\<^sub>1) (max_vars e\<^sub>2)"
 | "max_vars(Var V) = 0"
 | "max_vars(V:=e) = max_vars e"
 | "max_vars(e\<bullet>F{D}) = max_vars e"
 | "max_vars(C\<bullet>\<^sub>sF{D}) = 0"
 | "max_vars(FAss e\<^sub>1 F D e\<^sub>2) = max (max_vars e\<^sub>1) (max_vars e\<^sub>2)"
 | "max_vars(SFAss C F D e\<^sub>2) = max_vars e\<^sub>2"
 | "max_vars(e\<bullet>M(es)) = max (max_vars e) (max_varss es)"
 | "max_vars(C\<bullet>\<^sub>sM(es)) = max_varss es"
 | "max_vars({V:T; e}) = max_vars e + 1"
 | "max_vars(e\<^sub>1;;e\<^sub>2) = max (max_vars e\<^sub>1) (max_vars e\<^sub>2)"
 | "max_vars(if (e) e\<^sub>1 else e\<^sub>2) =
    max (max_vars e) (max (max_vars e\<^sub>1) (max_vars e\<^sub>2))"
 | "max_vars(while (b) e) = max (max_vars b) (max_vars e)"
 | "max_vars(throw e) = max_vars e"
 | "max_vars(try e\<^sub>1 catch(C V) e\<^sub>2) = max (max_vars e\<^sub>1) (max_vars e\<^sub>2 + 1)"
 | "max_vars(INIT C (Cs,b) \<leftarrow> e) = max_vars e"
 | "max_vars(RI(C,e);Cs \<leftarrow> e') = max (max_vars e) (max_vars e')"
 
 | "max_varss [] = 0"
 | "max_varss (e#es) = max (max_vars e) (max_varss es)"
 
 inductive
   eval\<^sub>1 :: "J\<^sub>1_prog \<Rightarrow> expr\<^sub>1 \<Rightarrow> state\<^sub>1 \<Rightarrow> expr\<^sub>1 \<Rightarrow> state\<^sub>1 \<Rightarrow> bool"
           ("_ \<turnstile>\<^sub>1 ((1\<langle>_,/_\<rangle>) \<Rightarrow>/ (1\<langle>_,/_\<rangle>))" [51,0,0,0,0] 81)
   and evals\<^sub>1 :: "J\<^sub>1_prog \<Rightarrow> expr\<^sub>1 list \<Rightarrow> state\<^sub>1 \<Rightarrow> expr\<^sub>1 list \<Rightarrow> state\<^sub>1 \<Rightarrow> bool"
            ("_ \<turnstile>\<^sub>1 ((1\<langle>_,/_\<rangle>) [\<Rightarrow>]/ (1\<langle>_,/_\<rangle>))" [51,0,0,0,0] 81)
   for P :: J\<^sub>1_prog
 where
 
   New\<^sub>1:
   "\<lbrakk> sh C = Some (sfs, Done); new_Addr h = Some a;
      P \<turnstile> C has_fields FDTs; h' = h(a\<mapsto>blank P C) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>new C,(h,l,sh)\<rangle> \<Rightarrow> \<langle>addr a,(h',l,sh)\<rangle>"
 | NewFail\<^sub>1:
   "\<lbrakk> sh C = Some (sfs, Done); new_Addr h = None \<rbrakk> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>new C, (h,l,sh)\<rangle> \<Rightarrow> \<langle>THROW OutOfMemory,(h,l,sh)\<rangle>"
 | NewInit\<^sub>1:
   "\<lbrakk> \<nexists>sfs. sh C = Some (sfs, Done); P \<turnstile>\<^sub>1 \<langle>INIT C ([C],False) \<leftarrow> unit,(h,l,sh)\<rangle> \<Rightarrow> \<langle>Val v',(h',l',sh')\<rangle>;
      new_Addr h' = Some a; P \<turnstile> C has_fields FDTs; h'' = h'(a\<mapsto>blank P C) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>new C,(h,l,sh)\<rangle> \<Rightarrow> \<langle>addr a,(h'',l',sh')\<rangle>"
 | NewInitOOM\<^sub>1:
   "\<lbrakk> \<nexists>sfs. sh C = Some (sfs, Done); P \<turnstile>\<^sub>1 \<langle>INIT C ([C],False) \<leftarrow> unit,(h,l,sh)\<rangle> \<Rightarrow> \<langle>Val v',(h',l',sh')\<rangle>;
      new_Addr h' = None; is_class P C \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>new C,(h,l,sh)\<rangle> \<Rightarrow> \<langle>THROW OutOfMemory,(h',l',sh')\<rangle>"
 | NewInitThrow\<^sub>1:
   "\<lbrakk> \<nexists>sfs. sh C = Some (sfs, Done); P \<turnstile>\<^sub>1 \<langle>INIT C ([C],False) \<leftarrow> unit,(h,l,sh)\<rangle> \<Rightarrow> \<langle>throw a,s'\<rangle>;
      is_class P C \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>new C,(h,l,sh)\<rangle> \<Rightarrow> \<langle>throw a,s'\<rangle>"
 
 | Cast\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,(h,l,sh)\<rangle>; h a = Some(D,fs); P \<turnstile> D \<preceq>\<^sup>* C \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>Cast C e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,(h,l,sh)\<rangle>"
 | CastNull\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>null,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>Cast C e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>null,s\<^sub>1\<rangle>"
 | CastFail\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,(h,l,sh)\<rangle>; h a = Some(D,fs); \<not> P \<turnstile> D \<preceq>\<^sup>* C \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>Cast C e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW ClassCast,(h,l,sh)\<rangle>"
 | CastThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>Cast C e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 
 | Val\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>Val v,s\<rangle> \<Rightarrow> \<langle>Val v,s\<rangle>"
 
 | BinOp\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v\<^sub>1,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>Val v\<^sub>2,s\<^sub>2\<rangle>; binop(bop,v\<^sub>1,v\<^sub>2) = Some v \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,s\<^sub>2\<rangle>"
 | BinOpThrow\<^sub>1\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2, s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e,s\<^sub>1\<rangle>"
 | BinOpThrow\<^sub>2\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v\<^sub>1,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>throw e,s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e,s\<^sub>2\<rangle>"
 
 | Var\<^sub>1:
   "\<lbrakk> ls!i = v; i < size ls \<rbrakk> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>Var i,(h,ls,sh)\<rangle> \<Rightarrow> \<langle>Val v,(h,ls,sh)\<rangle>"
 
 | LAss\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,(h,ls,sh)\<rangle>; i < size ls; ls' = ls[i := v] \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>i:= e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>unit,(h,ls',sh)\<rangle>"
 | LAssThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>i:= e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 
 | FAcc\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,(h,ls,sh)\<rangle>; h a = Some(C,fs);
      P \<turnstile> C has F,NonStatic:t in D;
      fs(F,D) = Some v \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<bullet>F{D},s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,(h,ls,sh)\<rangle>"
 | FAccNull\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>null,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e\<bullet>F{D},s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW NullPointer,s\<^sub>1\<rangle>"
 | FAccThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e\<bullet>F{D},s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 | FAccNone\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,(h,ls,sh)\<rangle>; h a = Some(C,fs);
     \<not>(\<exists>b t. P \<turnstile> C has F,b:t in D) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<bullet>F{D},s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW NoSuchFieldError,(h,ls,sh)\<rangle>"
 | FAccStatic\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,(h,ls,sh)\<rangle>; h a = Some(C,fs);
     P \<turnstile> C has F,Static:t in D \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<bullet>F{D},s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW IncompatibleClassChangeError,(h,ls,sh)\<rangle>"
 
 | SFAcc\<^sub>1:
   "\<lbrakk> P \<turnstile> C has F,Static:t in D;
      sh D = Some (sfs,Done);
      sfs F = Some v \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sF{D},(h,ls,sh)\<rangle> \<Rightarrow> \<langle>Val v,(h,ls,sh)\<rangle>"
 | SFAccInit\<^sub>1:
   "\<lbrakk> P \<turnstile> C has F,Static:t in D;
      \<nexists>sfs. sh D = Some (sfs,Done); P \<turnstile>\<^sub>1 \<langle>INIT D ([D],False) \<leftarrow> unit,(h,ls,sh)\<rangle> \<Rightarrow> \<langle>Val v',(h',ls',sh')\<rangle>;
      sh' D = Some (sfs,i);
      sfs F = Some v \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sF{D},(h,ls,sh)\<rangle> \<Rightarrow> \<langle>Val v,(h',ls',sh')\<rangle>"
 | SFAccInitThrow\<^sub>1:
   "\<lbrakk> P \<turnstile> C has F,Static:t in D;
      \<nexists>sfs. sh D = Some (sfs,Done); P \<turnstile>\<^sub>1 \<langle>INIT D ([D],False) \<leftarrow> unit,(h,ls,sh)\<rangle> \<Rightarrow> \<langle>throw a,s'\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sF{D},(h,ls,sh)\<rangle> \<Rightarrow> \<langle>throw a,s'\<rangle>"
 | SFAccNone\<^sub>1:
   "\<lbrakk> \<not>(\<exists>b t. P \<turnstile> C has F,b:t in D) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sF{D},s\<rangle> \<Rightarrow> \<langle>THROW NoSuchFieldError,s\<rangle>"
 | SFAccNonStatic\<^sub>1:
   "\<lbrakk> P \<turnstile> C has F,NonStatic:t in D \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sF{D},s\<rangle> \<Rightarrow> \<langle>THROW IncompatibleClassChangeError,s\<rangle>"
 
 
 | FAss\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>Val v,(h\<^sub>2,l\<^sub>2,sh\<^sub>2)\<rangle>;
      h\<^sub>2 a = Some(C,fs); P \<turnstile> C has F,NonStatic:t in D;
      fs' = fs((F,D)\<mapsto>v); h\<^sub>2' = h\<^sub>2(a\<mapsto>(C,fs')) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1\<bullet>F{D}:=e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>unit,(h\<^sub>2',l\<^sub>2,sh\<^sub>2)\<rangle>"
 | FAssNull\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>null,s\<^sub>1\<rangle>;  P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>Val v,s\<^sub>2\<rangle> \<rbrakk> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e\<^sub>1\<bullet>F{D}:=e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW NullPointer,s\<^sub>2\<rangle>"
 | FAssThrow\<^sub>1\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e\<^sub>1\<bullet>F{D}:=e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 | FAssThrow\<^sub>2\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1\<bullet>F{D}:=e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>2\<rangle>"
 | FAssNone\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>Val v,(h\<^sub>2,l\<^sub>2,sh\<^sub>2)\<rangle>;
      h\<^sub>2 a = Some(C,fs); \<not>(\<exists>b t. P \<turnstile> C has F,b:t in D) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1\<bullet>F{D}:=e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW NoSuchFieldError,(h\<^sub>2,l\<^sub>2,sh\<^sub>2)\<rangle>"
 | FAssStatic\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>Val v,(h\<^sub>2,l\<^sub>2,sh\<^sub>2)\<rangle>;
      h\<^sub>2 a = Some(C,fs); P \<turnstile> C has F,Static:t in D \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1\<bullet>F{D}:=e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW IncompatibleClassChangeError,(h\<^sub>2,l\<^sub>2,sh\<^sub>2)\<rangle>"
 
 | SFAss\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,(h\<^sub>1,l\<^sub>1,sh\<^sub>1)\<rangle>;
      P \<turnstile> C has F,Static:t in D;
      sh\<^sub>1 D = Some(sfs,Done); sfs' = sfs(F\<mapsto>v); sh\<^sub>1' = sh\<^sub>1(D\<mapsto>(sfs',Done)) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sF{D}:=e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>unit,(h\<^sub>1,l\<^sub>1,sh\<^sub>1')\<rangle>"
 | SFAssInit\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,(h\<^sub>1,l\<^sub>1,sh\<^sub>1)\<rangle>;
      P \<turnstile> C has F,Static:t in D;
      \<nexists>sfs. sh\<^sub>1 D = Some(sfs,Done); P \<turnstile>\<^sub>1 \<langle>INIT D ([D],False) \<leftarrow> unit,(h\<^sub>1,l\<^sub>1,sh\<^sub>1)\<rangle> \<Rightarrow> \<langle>Val v',(h',l',sh')\<rangle>;
      sh' D = Some(sfs,i);
      sfs' = sfs(F\<mapsto>v); sh'' = sh'(D\<mapsto>(sfs',i)) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sF{D}:=e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>unit,(h',l',sh'')\<rangle>"
 | SFAssInitThrow\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,(h\<^sub>1,l\<^sub>1,sh\<^sub>1)\<rangle>;
      P \<turnstile> C has F,Static:t in D;
      \<nexists>sfs. sh\<^sub>1 D = Some(sfs,Done); P \<turnstile>\<^sub>1 \<langle>INIT D ([D],False) \<leftarrow> unit,(h\<^sub>1,l\<^sub>1,sh\<^sub>1)\<rangle> \<Rightarrow> \<langle>throw a,s'\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sF{D}:=e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw a,s'\<rangle>"
 | SFAssThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>2\<rangle>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sF{D}:=e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>2\<rangle>"
 | SFAssNone\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,(h\<^sub>2,l\<^sub>2,sh\<^sub>2)\<rangle>;
     \<not>(\<exists>b t. P \<turnstile> C has F,b:t in D) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sF{D}:=e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW NoSuchFieldError,(h\<^sub>2,l\<^sub>2,sh\<^sub>2)\<rangle>"
 | SFAssNonStatic\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,(h\<^sub>2,l\<^sub>2,sh\<^sub>2)\<rangle>;
     P \<turnstile> C has F,NonStatic:t in D \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sF{D}:=e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW IncompatibleClassChangeError,(h\<^sub>2,l\<^sub>2,sh\<^sub>2)\<rangle>"
 
 | CallObjThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e\<bullet>M(es),s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 | CallNull\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>null,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>es,s\<^sub>1\<rangle> [\<Rightarrow>] \<langle>map Val vs,s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<bullet>M(es),s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW NullPointer,s\<^sub>2\<rangle>"
 | Call\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>es,s\<^sub>1\<rangle> [\<Rightarrow>] \<langle>map Val vs,(h\<^sub>2,ls\<^sub>2,sh\<^sub>2)\<rangle>;
     h\<^sub>2 a = Some(C,fs); P \<turnstile> C sees M,NonStatic:Ts\<rightarrow>T = body in D;
     size vs = size Ts; ls\<^sub>2' = (Addr a) # vs @ replicate (max_vars body) undefined;
     P \<turnstile>\<^sub>1 \<langle>body,(h\<^sub>2,ls\<^sub>2',sh\<^sub>2)\<rangle> \<Rightarrow> \<langle>e',(h\<^sub>3,ls\<^sub>3,sh\<^sub>3)\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<bullet>M(es),s\<^sub>0\<rangle> \<Rightarrow> \<langle>e',(h\<^sub>3,ls\<^sub>2,sh\<^sub>3)\<rangle>"
 | CallParamsThrow\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>es,s\<^sub>1\<rangle> [\<Rightarrow>] \<langle>es',s\<^sub>2\<rangle>;
      es' = map Val vs @ throw ex # es\<^sub>2 \<rbrakk>
    \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<bullet>M(es),s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw ex,s\<^sub>2\<rangle>"
 | CallNone\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,s\<^sub>1\<rangle>;  P \<turnstile>\<^sub>1 \<langle>ps,s\<^sub>1\<rangle> [\<Rightarrow>] \<langle>map Val vs,(h\<^sub>2,ls\<^sub>2,sh\<^sub>2)\<rangle>;
      h\<^sub>2 a = Some(C,fs); \<not>(\<exists>b Ts T body D. P \<turnstile> C sees M,b:Ts\<rightarrow>T = body in D) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<bullet>M(ps),s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW NoSuchMethodError,(h\<^sub>2,ls\<^sub>2,sh\<^sub>2)\<rangle>"
 | CallStatic\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,s\<^sub>1\<rangle>;  P \<turnstile>\<^sub>1 \<langle>ps,s\<^sub>1\<rangle> [\<Rightarrow>] \<langle>map Val vs,(h\<^sub>2,ls\<^sub>2,sh\<^sub>2)\<rangle>;
      h\<^sub>2 a = Some(C,fs); P \<turnstile> C sees M,Static:Ts\<rightarrow>T = body in D \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<bullet>M(ps),s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW IncompatibleClassChangeError,(h\<^sub>2,ls\<^sub>2,sh\<^sub>2)\<rangle>"
 
 | SCallParamsThrow\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>es,s\<^sub>0\<rangle> [\<Rightarrow>] \<langle>es',s\<^sub>2\<rangle>; es' = map Val vs @ throw ex # es\<^sub>2 \<rbrakk>
    \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sM(es),s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw ex,s\<^sub>2\<rangle>"
 | SCallNone\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>ps,s\<^sub>0\<rangle> [\<Rightarrow>] \<langle>map Val vs,s\<^sub>2\<rangle>;
      \<not>(\<exists>b Ts T body D. P \<turnstile> C sees M,b:Ts\<rightarrow>T = body in D) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sM(ps),s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW NoSuchMethodError,s\<^sub>2\<rangle>"
 | SCallNonStatic\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>ps,s\<^sub>0\<rangle> [\<Rightarrow>] \<langle>map Val vs,s\<^sub>2\<rangle>;
      P \<turnstile> C sees M,NonStatic:Ts\<rightarrow>T = body in D \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sM(ps),s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW IncompatibleClassChangeError,s\<^sub>2\<rangle>"
 | SCallInitThrow\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>ps,s\<^sub>0\<rangle> [\<Rightarrow>] \<langle>map Val vs,(h\<^sub>1,ls\<^sub>1,sh\<^sub>1)\<rangle>;
      P \<turnstile> C sees M,Static:Ts\<rightarrow>T = body in D;
      \<nexists>sfs. sh\<^sub>1 D = Some(sfs,Done); M \<noteq> clinit;
      P \<turnstile>\<^sub>1 \<langle>INIT D ([D],False) \<leftarrow> unit,(h\<^sub>1,ls\<^sub>1,sh\<^sub>1)\<rangle> \<Rightarrow> \<langle>throw a,s'\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sM(ps),s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw a,s'\<rangle>"
 | SCallInit\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>ps,s\<^sub>0\<rangle> [\<Rightarrow>] \<langle>map Val vs,(h\<^sub>1,ls\<^sub>1,sh\<^sub>1)\<rangle>;
      P \<turnstile> C sees M,Static:Ts\<rightarrow>T = body in D;
      \<nexists>sfs. sh\<^sub>1 D = Some(sfs,Done); M \<noteq> clinit;
      P \<turnstile>\<^sub>1 \<langle>INIT D ([D],False) \<leftarrow> unit,(h\<^sub>1,ls\<^sub>1,sh\<^sub>1)\<rangle> \<Rightarrow> \<langle>Val v',(h\<^sub>2,ls\<^sub>2,sh\<^sub>2)\<rangle>;
      size vs = size Ts; ls\<^sub>2' = vs @ replicate (max_vars body) undefined;
      P \<turnstile>\<^sub>1 \<langle>body,(h\<^sub>2,ls\<^sub>2',sh\<^sub>2)\<rangle> \<Rightarrow> \<langle>e',(h\<^sub>3,ls\<^sub>3,sh\<^sub>3)\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sM(ps),s\<^sub>0\<rangle> \<Rightarrow> \<langle>e',(h\<^sub>3,ls\<^sub>2,sh\<^sub>3)\<rangle>"
 | SCall\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>ps,s\<^sub>0\<rangle> [\<Rightarrow>] \<langle>map Val vs,(h\<^sub>2,ls\<^sub>2,sh\<^sub>2)\<rangle>;
      P \<turnstile> C sees M,Static:Ts\<rightarrow>T = body in D;
      sh\<^sub>2 D = Some(sfs,Done) \<or> (M = clinit \<and> sh\<^sub>2 D = \<lfloor>(sfs, Processing)\<rfloor>);
      size vs = size Ts; ls\<^sub>2' = vs @ replicate (max_vars body) undefined;
      P \<turnstile>\<^sub>1 \<langle>body,(h\<^sub>2,ls\<^sub>2',sh\<^sub>2)\<rangle> \<Rightarrow> \<langle>e',(h\<^sub>3,ls\<^sub>3,sh\<^sub>3)\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sM(ps),s\<^sub>0\<rangle> \<Rightarrow> \<langle>e',(h\<^sub>3,ls\<^sub>2,sh\<^sub>3)\<rangle>"
 
 | Block\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e',s\<^sub>1\<rangle> \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>Block i T e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e',s\<^sub>1\<rangle>"
 
 | Seq\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>0,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>1\<rangle> \<Rightarrow> \<langle>e\<^sub>2,s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e\<^sub>0;;e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e\<^sub>2,s\<^sub>2\<rangle>"
 | SeqThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e\<^sub>0,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e\<^sub>0;;e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e,s\<^sub>1\<rangle>"
 
 | CondT\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>true,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>1\<rangle> \<Rightarrow> \<langle>e',s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>if (e) e\<^sub>1 else e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e',s\<^sub>2\<rangle>"
 | CondF\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>false,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,s\<^sub>1\<rangle> \<Rightarrow> \<langle>e',s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>if (e) e\<^sub>1 else e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e',s\<^sub>2\<rangle>"
 | CondThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>if (e) e\<^sub>1 else e\<^sub>2, s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 
 | WhileF\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>false,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>while (e) c,s\<^sub>0\<rangle> \<Rightarrow> \<langle>unit,s\<^sub>1\<rangle>"
 | WhileT\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>true,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>c,s\<^sub>1\<rangle> \<Rightarrow> \<langle>Val v\<^sub>1,s\<^sub>2\<rangle>;
     P \<turnstile>\<^sub>1 \<langle>while (e) c,s\<^sub>2\<rangle> \<Rightarrow> \<langle>e\<^sub>3,s\<^sub>3\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>while (e) c,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e\<^sub>3,s\<^sub>3\<rangle>"
 | WhileCondThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>while (e) c,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 | WhileBodyThrow\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>true,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>c,s\<^sub>1\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>2\<rangle>\<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>while (e) c,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>2\<rangle>"
 
 | Throw\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>addr a,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>throw e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Throw a,s\<^sub>1\<rangle>"
 | ThrowNull\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>null,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>throw e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>THROW NullPointer,s\<^sub>1\<rangle>"
 | ThrowThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>throw e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle>"
 
 | Try\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v\<^sub>1,s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>try e\<^sub>1 catch(C i) e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v\<^sub>1,s\<^sub>1\<rangle>"
 | TryCatch\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Throw a,(h\<^sub>1,ls\<^sub>1,sh\<^sub>1)\<rangle>;
     h\<^sub>1 a = Some(D,fs); P \<turnstile> D \<preceq>\<^sup>* C; i < length ls\<^sub>1;
     P \<turnstile>\<^sub>1 \<langle>e\<^sub>2,(h\<^sub>1,ls\<^sub>1[i:=Addr a],sh\<^sub>1)\<rangle> \<Rightarrow> \<langle>e\<^sub>2',(h\<^sub>2,ls\<^sub>2,sh\<^sub>2)\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>try e\<^sub>1 catch(C i) e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>e\<^sub>2',(h\<^sub>2,ls\<^sub>2,sh\<^sub>2)\<rangle>"
 | TryThrow\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e\<^sub>1,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Throw a,(h\<^sub>1,ls\<^sub>1,sh\<^sub>1)\<rangle>; h\<^sub>1 a = Some(D,fs); \<not> P \<turnstile> D \<preceq>\<^sup>* C \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>try e\<^sub>1 catch(C i) e\<^sub>2,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Throw a,(h\<^sub>1,ls\<^sub>1,sh\<^sub>1)\<rangle>"
 
 | Nil\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>[],s\<rangle> [\<Rightarrow>] \<langle>[],s\<rangle>"
 
 | Cons\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>Val v,s\<^sub>1\<rangle>; P \<turnstile>\<^sub>1 \<langle>es,s\<^sub>1\<rangle> [\<Rightarrow>] \<langle>es',s\<^sub>2\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>e#es,s\<^sub>0\<rangle> [\<Rightarrow>] \<langle>Val v # es',s\<^sub>2\<rangle>"
 | ConsThrow\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<^sub>0\<rangle> \<Rightarrow> \<langle>throw e',s\<^sub>1\<rangle> \<Longrightarrow>
   P \<turnstile>\<^sub>1 \<langle>e#es,s\<^sub>0\<rangle> [\<Rightarrow>] \<langle>throw e' # es, s\<^sub>1\<rangle>"
 
 \<comment> \<open> init rules \<close>
 
 | InitFinal\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>e,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle> \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>INIT C (Nil,b) \<leftarrow> e,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
 | InitNone\<^sub>1:
   "\<lbrakk> sh C = None; P \<turnstile>\<^sub>1 \<langle>INIT C' (C#Cs,False) \<leftarrow> e,(h,l,sh(C \<mapsto> (sblank P C, Prepared)))\<rangle> \<Rightarrow> \<langle>e',s'\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>INIT C' (C#Cs,False) \<leftarrow> e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
 | InitDone\<^sub>1:
   "\<lbrakk> sh C = Some(sfs,Done); P \<turnstile>\<^sub>1 \<langle>INIT C' (Cs,True) \<leftarrow> e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',s'\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>INIT C' (C#Cs,False) \<leftarrow> e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
 | InitProcessing\<^sub>1:
   "\<lbrakk> sh C = Some(sfs,Processing); P \<turnstile>\<^sub>1 \<langle>INIT C' (Cs,True) \<leftarrow> e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',s'\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>INIT C' (C#Cs,False) \<leftarrow> e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
 | InitError\<^sub>1:
   "\<lbrakk> sh C = Some(sfs,Error);
      P \<turnstile>\<^sub>1 \<langle>RI (C, THROW NoClassDefFoundError);Cs \<leftarrow> e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',s'\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>INIT C' (C#Cs,False) \<leftarrow> e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
 | InitObject\<^sub>1:
   "\<lbrakk> sh C = Some(sfs,Prepared);
      C = Object;
      sh' = sh(C \<mapsto> (sfs,Processing));
      P \<turnstile>\<^sub>1 \<langle>INIT C' (C#Cs,True) \<leftarrow> e,(h,l,sh')\<rangle> \<Rightarrow> \<langle>e',s'\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>INIT C' (C#Cs,False) \<leftarrow> e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
 | InitNonObject\<^sub>1:
   "\<lbrakk> sh C = Some(sfs,Prepared);
      C \<noteq> Object;
      class P C = Some (D,r);
      sh' = sh(C \<mapsto> (sfs,Processing));
      P \<turnstile>\<^sub>1 \<langle>INIT C' (D#C#Cs,False) \<leftarrow> e,(h,l,sh')\<rangle> \<Rightarrow> \<langle>e',s'\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>INIT C' (C#Cs,False) \<leftarrow> e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
 | InitRInit\<^sub>1:
   "P \<turnstile>\<^sub>1 \<langle>RI (C,C\<bullet>\<^sub>sclinit([]));Cs \<leftarrow> e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>INIT C' (C#Cs,True) \<leftarrow> e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
 
 | RInit\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<rangle> \<Rightarrow> \<langle>Val v, (h',l',sh')\<rangle>;
      sh' C = Some(sfs, i); sh'' = sh'(C \<mapsto> (sfs, Done));
      C' = last(C#Cs);
      P \<turnstile>\<^sub>1 \<langle>INIT C' (Cs,True) \<leftarrow> e', (h',l',sh'')\<rangle> \<Rightarrow> \<langle>e\<^sub>1,s\<^sub>1\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>RI (C,e);Cs \<leftarrow> e',s\<rangle> \<Rightarrow> \<langle>e\<^sub>1,s\<^sub>1\<rangle>"
 | RInitInitFail\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<rangle> \<Rightarrow> \<langle>throw a, (h',l',sh')\<rangle>;
      sh' C = Some(sfs, i); sh'' = sh'(C \<mapsto> (sfs, Error));
      P \<turnstile>\<^sub>1 \<langle>RI (D,throw a);Cs \<leftarrow> e', (h',l',sh'')\<rangle> \<Rightarrow> \<langle>e\<^sub>1,s\<^sub>1\<rangle> \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>RI (C,e);D#Cs \<leftarrow> e',s\<rangle> \<Rightarrow> \<langle>e\<^sub>1,s\<^sub>1\<rangle>"
 | RInitFailFinal\<^sub>1:
   "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<rangle> \<Rightarrow> \<langle>throw a, (h',l',sh')\<rangle>;
      sh' C = Some(sfs, i); sh'' = sh'(C \<mapsto> (sfs, Error)) \<rbrakk>
   \<Longrightarrow> P \<turnstile>\<^sub>1 \<langle>RI (C,e);Nil \<leftarrow> e',s\<rangle> \<Rightarrow> \<langle>throw a, (h',l',sh'')\<rangle>"
 
 
 (*<*)
 lemmas eval\<^sub>1_evals\<^sub>1_induct = eval\<^sub>1_evals\<^sub>1.induct [split_format (complete)]
   and eval\<^sub>1_evals\<^sub>1_inducts = eval\<^sub>1_evals\<^sub>1.inducts [split_format (complete)]
 (*>*)
 
 
 inductive_cases eval\<^sub>1_cases [cases set]:
  "P \<turnstile>\<^sub>1 \<langle>new C,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>Cast C e,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>Val v,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>Var v,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>V:=e,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>e\<bullet>F{D},s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sF{D},s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>e\<^sub>1\<bullet>F{D}:=e\<^sub>2,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sF{D}:=e\<^sub>2,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>e\<bullet>M(es),s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>C\<bullet>\<^sub>sM(es),s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>{V:T;e\<^sub>1},s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>e\<^sub>1;;e\<^sub>2,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>if (e) e\<^sub>1 else e\<^sub>2,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>while (b) c,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>throw e,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>try e\<^sub>1 catch(C V) e\<^sub>2,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>INIT C (Cs,b) \<leftarrow> e,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>RI (C,e);Cs \<leftarrow> e\<^sub>0,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
  
 inductive_cases evals\<^sub>1_cases [cases set]:
  "P \<turnstile>\<^sub>1 \<langle>[],s\<rangle> [\<Rightarrow>] \<langle>e',s'\<rangle>"
  "P \<turnstile>\<^sub>1 \<langle>e#es,s\<rangle> [\<Rightarrow>] \<langle>e',s'\<rangle>"
 (*>*) 
 
 
 lemma eval\<^sub>1_final: "P \<turnstile>\<^sub>1 \<langle>e,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle> \<Longrightarrow> final e'"
  and evals\<^sub>1_final: "P \<turnstile>\<^sub>1 \<langle>es,s\<rangle> [\<Rightarrow>] \<langle>es',s'\<rangle> \<Longrightarrow> finals es'"
 (*<*)by(induct rule:eval\<^sub>1_evals\<^sub>1.inducts, simp_all)(*>*)
 
 
-lemma eval\<^sub>1_final_same: "\<lbrakk> P \<turnstile>\<^sub>1 \<langle>e,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>; final e \<rbrakk> \<Longrightarrow> e = e' \<and> s = s'"
+lemma eval\<^sub>1_final_same:
+assumes eval: "P \<turnstile>\<^sub>1 \<langle>e,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>" shows "final e \<Longrightarrow> e = e' \<and> s = s'"
 (*<*)
-apply(erule finalE)
- using eval\<^sub>1_cases(3) apply blast
-by (metis eval\<^sub>1_cases(3,17) exp.distinct(101) exp.inject(3) val.distinct(13))
+proof(erule finalE)
+  fix v assume Val: "e = Val v"
+  then show ?thesis using eval eval\<^sub>1_cases(3) by blast
+next
+  fix a assume "e = Throw a"
+  then show ?thesis using eval
+    by (metis eval\<^sub>1_cases(3,17) exp.distinct(101) exp.inject(3) val.distinct(13))
+qed
 (*>*)
 
 subsection "Property preservation"
 
 lemma eval\<^sub>1_preserves_len:
   "P \<turnstile>\<^sub>1 \<langle>e\<^sub>0,(h\<^sub>0,ls\<^sub>0,sh\<^sub>0)\<rangle> \<Rightarrow> \<langle>e\<^sub>1,(h\<^sub>1,ls\<^sub>1,sh\<^sub>1)\<rangle> \<Longrightarrow> length ls\<^sub>0 = length ls\<^sub>1"
 and evals\<^sub>1_preserves_len:
   "P \<turnstile>\<^sub>1 \<langle>es\<^sub>0,(h\<^sub>0,ls\<^sub>0,sh\<^sub>0)\<rangle> [\<Rightarrow>] \<langle>es\<^sub>1,(h\<^sub>1,ls\<^sub>1,sh\<^sub>1)\<rangle> \<Longrightarrow> length ls\<^sub>0 = length ls\<^sub>1"
 (*<*)by (induct rule:eval\<^sub>1_evals\<^sub>1_inducts, simp_all)(*>*)
 
 
 lemma evals\<^sub>1_preserves_elen:
   "\<And>es' s s'. P \<turnstile>\<^sub>1 \<langle>es,s\<rangle> [\<Rightarrow>] \<langle>es',s'\<rangle> \<Longrightarrow> length es = length es'"
-(*<*)
-apply(induct es type:list)
-apply (auto elim:evals\<^sub>1.cases)
-done
-(*>*)
+(*<*)by(induct es type:list) (auto elim:evals\<^sub>1.cases)(*>*)
 
 
 lemma clinit\<^sub>1_loc_pres:
  "P \<turnstile>\<^sub>1 \<langle>C\<^sub>0\<bullet>\<^sub>sclinit([]),(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',(h',l',sh')\<rangle> \<Longrightarrow> l = l'"
  by(auto elim!: eval\<^sub>1_cases(12) evals\<^sub>1_cases(1))
 
 lemma
 shows init\<^sub>1_ri\<^sub>1_same_loc: "P \<turnstile>\<^sub>1 \<langle>e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',(h',l',sh')\<rangle>
    \<Longrightarrow> (\<And>C Cs b M a. e = INIT C (Cs,b) \<leftarrow> unit \<or> e = C\<bullet>\<^sub>sM([]) \<or> e = RI (C,Throw a) ; Cs \<leftarrow> unit
           \<or> e = RI (C,C\<bullet>\<^sub>sclinit([])) ; Cs \<leftarrow> unit
            \<Longrightarrow> l = l')"
   and "P \<turnstile>\<^sub>1 \<langle>es,(h,l,sh)\<rangle> [\<Rightarrow>] \<langle>es',(h',l',sh')\<rangle> \<Longrightarrow> True"
 proof(induct rule: eval\<^sub>1_evals\<^sub>1_inducts)
   case (RInitInitFail\<^sub>1 e h l sh a')
   then show ?case using eval\<^sub>1_final[of _ _ _ "throw a'"]
      by(fastforce dest: eval\<^sub>1_final_same[of _ "Throw a"])
 next
   case RInitFailFinal\<^sub>1 then show ?case by(auto dest: eval\<^sub>1_final_same)
 qed(auto dest: evals\<^sub>1_cases eval\<^sub>1_cases(17) eval\<^sub>1_final_same)
 
 lemma init\<^sub>1_same_loc: "P \<turnstile>\<^sub>1 \<langle>INIT C (Cs,b) \<leftarrow> unit,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',(h',l',sh')\<rangle> \<Longrightarrow> l = l'"
  by(simp add: init\<^sub>1_ri\<^sub>1_same_loc)
 
 
 theorem eval\<^sub>1_hext: "P \<turnstile>\<^sub>1 \<langle>e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',(h',l',sh')\<rangle> \<Longrightarrow> h \<unlhd> h'"
 and evals\<^sub>1_hext:  "P \<turnstile>\<^sub>1 \<langle>es,(h,l,sh)\<rangle> [\<Rightarrow>] \<langle>es',(h',l',sh')\<rangle> \<Longrightarrow> h \<unlhd> h'"
 (*<*)
 proof (induct rule: eval\<^sub>1_evals\<^sub>1_inducts)
   case New\<^sub>1 thus ?case
     by(fastforce intro!: hext_new intro:LeastI simp:new_Addr_def
                 split:if_split_asm simp del:fun_upd_apply)
 next
   case NewInit\<^sub>1 thus ?case
     by (meson hext_new hext_trans new_Addr_SomeD)
 next
   case FAss\<^sub>1 thus ?case
     by(auto simp:sym[THEN hext_upd_obj] simp del:fun_upd_apply
             elim!: hext_trans)
 qed (auto elim!: hext_trans)
 (*>*)
 
 subsection "Initialization"
 
 lemma rinit\<^sub>1_throw:
  "P\<^sub>1 \<turnstile>\<^sub>1 \<langle>RI (D,Throw xa) ; Cs \<leftarrow> e,(h, l, sh)\<rangle> \<Rightarrow> \<langle>e',(h', l', sh')\<rangle>
     \<Longrightarrow> e' = Throw xa"
-apply(induct Cs arbitrary: D h l sh h' l' sh')
- apply(drule eval\<^sub>1_cases(20), auto elim: eval\<^sub>1_cases)
-apply(drule eval\<^sub>1_cases(20), auto elim: eval\<^sub>1_cases dest: eval\<^sub>1_final_same simp: final_def)
-done
+proof(induct Cs arbitrary: D h l sh h' l' sh')
+  case Nil then show ?case
+  proof(rule eval\<^sub>1_cases(20)) qed(auto elim: eval\<^sub>1_cases)
+next
+  case (Cons C Cs) show ?case using Cons.prems
+  proof(induct rule: eval\<^sub>1_cases(20))
+    case RInit\<^sub>1: 1
+    then show ?case using Cons.hyps by(auto elim: eval\<^sub>1_cases)
+  next
+    case RInitInitFail\<^sub>1: 2
+    then show ?case using Cons.hyps eval\<^sub>1_final_same final_def by blast
+  next
+    case RInitFailFinal\<^sub>1: 3 then show ?case by simp
+  qed
+qed
 
 lemma rinit\<^sub>1_throwE:
 "P \<turnstile>\<^sub>1 \<langle>RI (C,throw e) ; Cs \<leftarrow> e\<^sub>0,s\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>
    \<Longrightarrow> \<exists>a s\<^sub>t. e' = throw a \<and> P \<turnstile>\<^sub>1 \<langle>throw e,s\<rangle> \<Rightarrow> \<langle>throw a,s\<^sub>t\<rangle>"
 proof(induct Cs arbitrary: C e s)
   case Nil
   then show ?case
   proof(rule eval\<^sub>1_cases(20)) \<comment> \<open> RI \<close>
     fix v h' l' sh' assume "P \<turnstile>\<^sub>1 \<langle>throw e,s\<rangle> \<Rightarrow> \<langle>Val v,(h', l', sh')\<rangle>"
     then show ?case using eval\<^sub>1_cases(17) by blast
   qed(auto)
 next
   case (Cons C' Cs')
   show ?case using Cons.prems(1)
   proof(rule eval\<^sub>1_cases(20)) \<comment> \<open> RI \<close>
     fix v h' l' sh' assume "P \<turnstile>\<^sub>1 \<langle>throw e,s\<rangle> \<Rightarrow> \<langle>Val v,(h', l', sh')\<rangle>"
     then show ?case using eval\<^sub>1_cases(17) by blast
   next
     fix a h' l' sh' sfs i D Cs''
     assume e''step: "P \<turnstile>\<^sub>1 \<langle>throw e,s\<rangle> \<Rightarrow> \<langle>throw a,(h', l', sh')\<rangle>"
        and shC: "sh' C = \<lfloor>(sfs, i)\<rfloor>"
        and riD: "P \<turnstile>\<^sub>1 \<langle>RI (D,throw a) ; Cs'' \<leftarrow> e\<^sub>0,(h', l', sh'(C \<mapsto> (sfs, Error)))\<rangle> \<Rightarrow> \<langle>e',s'\<rangle>"
        and "C' # Cs' = D # Cs''"
     then show ?thesis using Cons.hyps eval\<^sub>1_final eval\<^sub>1_final_same by blast
   qed(simp)
 qed
 
 end
diff --git a/thys/JinjaDCI/Compiler/J1WellForm.thy b/thys/JinjaDCI/Compiler/J1WellForm.thy
--- a/thys/JinjaDCI/Compiler/J1WellForm.thy
+++ b/thys/JinjaDCI/Compiler/J1WellForm.thy
@@ -1,531 +1,519 @@
 (*  Title:      JinjaDCI/Compiler/J1WellForm.thy
 
     Author:     Tobias Nipkow, Susannah Mansky
     Copyright   2003 Technische Universitaet Muenchen, 2019-20 UIUC
 
     Based on the Jinja theory Compiler/J1WellForm.thy by Tobias Nipkow
 *)
 
 section \<open> Well-Formedness of Intermediate Language \<close>
 
 theory J1WellForm
 imports "../J/JWellForm" J1
 begin
 
 subsection "Well-Typedness"
 
 type_synonym 
   env\<^sub>1  = "ty list"   \<comment> \<open>type environment indexed by variable number\<close>
 
 inductive
   WT\<^sub>1 :: "[J\<^sub>1_prog,env\<^sub>1, expr\<^sub>1     , ty     ] \<Rightarrow> bool"
          ("(_,_ \<turnstile>\<^sub>1/ _ :: _)"   [51,51,51]50)
   and WTs\<^sub>1 :: "[J\<^sub>1_prog,env\<^sub>1, expr\<^sub>1 list, ty list] \<Rightarrow> bool"
          ("(_,_ \<turnstile>\<^sub>1/ _ [::] _)" [51,51,51]50)
   for P :: J\<^sub>1_prog
 where
   
   WTNew\<^sub>1:
   "is_class P C  \<Longrightarrow>
   P,E \<turnstile>\<^sub>1 new C :: Class C"
 
 | WTCast\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e :: Class D;  is_class P C;  P \<turnstile> C \<preceq>\<^sup>* D \<or> P \<turnstile> D \<preceq>\<^sup>* C \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 Cast C e :: Class C"
 
 | WTVal\<^sub>1:
   "typeof v = Some T \<Longrightarrow>
   P,E \<turnstile>\<^sub>1 Val v :: T"
 
 | WTVar\<^sub>1:
   "\<lbrakk> E!i = T; i < size E \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 Var i :: T"
 
 | WTBinOp\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e\<^sub>1 :: T\<^sub>1;  P,E \<turnstile>\<^sub>1 e\<^sub>2 :: T\<^sub>2;
      case bop of Eq \<Rightarrow> (P \<turnstile> T\<^sub>1 \<le> T\<^sub>2 \<or> P \<turnstile> T\<^sub>2 \<le> T\<^sub>1) \<and> T = Boolean
                | Add \<Rightarrow> T\<^sub>1 = Integer \<and> T\<^sub>2 = Integer \<and> T = Integer \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2 :: T"
 
 | WTLAss\<^sub>1:
   "\<lbrakk> E!i = T;  i < size E; P,E \<turnstile>\<^sub>1 e :: T';  P \<turnstile> T' \<le> T \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 i:=e :: Void"
 
 | WTFAcc\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e :: Class C;  P \<turnstile> C sees F,NonStatic:T in D \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 e\<bullet>F{D} :: T"
 
 | WTSFAcc\<^sub>1:
   "\<lbrakk> P \<turnstile> C sees F,Static:T in D \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 C\<bullet>\<^sub>sF{D} :: T"
 
 | WTFAss\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e\<^sub>1 :: Class C;  P \<turnstile> C sees F,NonStatic:T in D;  P,E \<turnstile>\<^sub>1 e\<^sub>2 :: T';  P \<turnstile> T' \<le> T \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 e\<^sub>1\<bullet>F{D} := e\<^sub>2 :: Void"
 
 | WTSFAss\<^sub>1:
   "\<lbrakk>  P \<turnstile> C sees F,Static:T in D;  P,E \<turnstile>\<^sub>1 e\<^sub>2 :: T';  P \<turnstile> T' \<le> T \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 C\<bullet>\<^sub>sF{D}:=e\<^sub>2 :: Void"
 
 | WTCall\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e :: Class C; P \<turnstile> C sees M,NonStatic:Ts' \<rightarrow> T = m in D;
     P,E \<turnstile>\<^sub>1 es [::] Ts;  P \<turnstile> Ts [\<le>] Ts' \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 e\<bullet>M(es) :: T"
 
 | WTSCall\<^sub>1:
   "\<lbrakk> P \<turnstile> C sees M,Static:Ts \<rightarrow> T = m in D;
      P,E \<turnstile>\<^sub>1 es [::] Ts';  P \<turnstile> Ts' [\<le>] Ts; M \<noteq> clinit \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 C\<bullet>\<^sub>sM(es) :: T"
 
 | WTBlock\<^sub>1:
   "\<lbrakk> is_type P T; P,E@[T] \<turnstile>\<^sub>1 e::T' \<rbrakk>
   \<Longrightarrow>  P,E \<turnstile>\<^sub>1 {i:T; e} :: T'"
 
 | WTSeq\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e\<^sub>1::T\<^sub>1;  P,E \<turnstile>\<^sub>1 e\<^sub>2::T\<^sub>2 \<rbrakk>
   \<Longrightarrow>  P,E \<turnstile>\<^sub>1 e\<^sub>1;;e\<^sub>2 :: T\<^sub>2"
 
 | WTCond\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e :: Boolean;  P,E \<turnstile>\<^sub>1 e\<^sub>1::T\<^sub>1;  P,E \<turnstile>\<^sub>1 e\<^sub>2::T\<^sub>2;
     P \<turnstile> T\<^sub>1 \<le> T\<^sub>2 \<or> P \<turnstile> T\<^sub>2 \<le> T\<^sub>1;  P \<turnstile> T\<^sub>1 \<le> T\<^sub>2 \<longrightarrow> T = T\<^sub>2; P \<turnstile> T\<^sub>2 \<le> T\<^sub>1 \<longrightarrow> T = T\<^sub>1 \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 if (e) e\<^sub>1 else e\<^sub>2 :: T"
 
 | WTWhile\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e :: Boolean;  P,E \<turnstile>\<^sub>1 c::T \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 while (e) c :: Void"
 
 | WTThrow\<^sub>1:
   "P,E \<turnstile>\<^sub>1 e :: Class C  \<Longrightarrow>
   P,E \<turnstile>\<^sub>1 throw e :: Void"
 
 | WTTry\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e\<^sub>1 :: T;  P,E@[Class C] \<turnstile>\<^sub>1 e\<^sub>2 :: T; is_class P C \<rbrakk>
   \<Longrightarrow> P,E \<turnstile>\<^sub>1 try e\<^sub>1 catch(C i) e\<^sub>2 :: T"
 
 | WTNil\<^sub>1:
   "P,E \<turnstile>\<^sub>1 [] [::] []"
 
 | WTCons\<^sub>1:
   "\<lbrakk> P,E \<turnstile>\<^sub>1 e :: T; P,E \<turnstile>\<^sub>1 es [::] Ts \<rbrakk>
   \<Longrightarrow>  P,E \<turnstile>\<^sub>1 e#es [::] T#Ts"
 
 (*<*)
 declare  WT\<^sub>1_WTs\<^sub>1.intros[intro!]
 declare WTNil\<^sub>1[iff]
 
 lemmas WT\<^sub>1_WTs\<^sub>1_induct = WT\<^sub>1_WTs\<^sub>1.induct [split_format (complete)]
   and WT\<^sub>1_WTs\<^sub>1_inducts = WT\<^sub>1_WTs\<^sub>1.inducts [split_format (complete)]
 
 inductive_cases eee[elim!]:
   "P,E \<turnstile>\<^sub>1 Val v :: T"
   "P,E \<turnstile>\<^sub>1 Var i :: T"
   "P,E \<turnstile>\<^sub>1 Cast D e :: T"
   "P,E \<turnstile>\<^sub>1 i:=e :: T"
   "P,E \<turnstile>\<^sub>1 {i:U; e} :: T"
   "P,E \<turnstile>\<^sub>1 e\<^sub>1;;e\<^sub>2 :: T"
   "P,E \<turnstile>\<^sub>1 if (e) e\<^sub>1 else e\<^sub>2 :: T"
   "P,E \<turnstile>\<^sub>1 while (e) c :: T"
   "P,E \<turnstile>\<^sub>1 throw e :: T"
   "P,E \<turnstile>\<^sub>1 try e\<^sub>1 catch(C i) e\<^sub>2 :: T"
   "P,E \<turnstile>\<^sub>1 e\<bullet>F{D} :: T"
   "P,E \<turnstile>\<^sub>1 C\<bullet>\<^sub>sF{D} :: T"
   "P,E \<turnstile>\<^sub>1 e\<^sub>1\<bullet>F{D}:=e\<^sub>2 :: T"
   "P,E \<turnstile>\<^sub>1 C\<bullet>\<^sub>sF{D}:=e\<^sub>2 :: T"
   "P,E \<turnstile>\<^sub>1 e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2 :: T"
   "P,E \<turnstile>\<^sub>1 new C :: T"
   "P,E \<turnstile>\<^sub>1 e\<bullet>M(es) :: T"
   "P,E \<turnstile>\<^sub>1 C\<bullet>\<^sub>sM(es) :: T"
   "P,E \<turnstile>\<^sub>1 [] [::] Ts"
   "P,E \<turnstile>\<^sub>1 e#es [::] Ts"
 (*>*)
 
 lemma init_nWT\<^sub>1 [simp]:"\<not>P,E \<turnstile>\<^sub>1 INIT C (Cs,b) \<leftarrow> e :: T"
  by(auto elim:WT\<^sub>1.cases)
 lemma rinit_nWT\<^sub>1 [simp]:"\<not>P,E \<turnstile>\<^sub>1 RI(C,e);Cs \<leftarrow> e' :: T"
  by(auto elim:WT\<^sub>1.cases)
 
 lemma WTs\<^sub>1_same_size: "\<And>Ts. P,E \<turnstile>\<^sub>1 es [::] Ts \<Longrightarrow> size es = size Ts"
 (*<*)by (induct es type:list) auto(*>*)
 
 
 lemma WT\<^sub>1_unique:
   "P,E \<turnstile>\<^sub>1 e :: T\<^sub>1 \<Longrightarrow> (\<And>T\<^sub>2. P,E \<turnstile>\<^sub>1 e :: T\<^sub>2 \<Longrightarrow> T\<^sub>1 = T\<^sub>2)" and
   WTs\<^sub>1_unique: "P,E \<turnstile>\<^sub>1 es [::] Ts\<^sub>1 \<Longrightarrow> (\<And>Ts\<^sub>2. P,E \<turnstile>\<^sub>1 es [::] Ts\<^sub>2 \<Longrightarrow> Ts\<^sub>1 = Ts\<^sub>2)"
 (*<*)
-apply(induct rule:WT\<^sub>1_WTs\<^sub>1.inducts)
-apply blast
-apply blast
-apply clarsimp
-apply blast
-apply clarsimp
-apply(case_tac bop)
-apply clarsimp
-apply clarsimp
-apply blast
-apply (blast dest:sees_field_idemp sees_field_fun)
-apply (blast dest:sees_field_fun)
-apply blast
-apply (blast dest:sees_field_fun)
-apply (blast dest:sees_method_idemp sees_method_fun)
-apply (blast dest:sees_method_fun)
-apply blast
-apply blast
-apply blast
-apply blast
-apply clarify
-apply blast
-apply blast
-apply blast
-done
+proof(induct rule:WT\<^sub>1_WTs\<^sub>1.inducts)
+  case WTVal\<^sub>1 then show ?case by clarsimp
+next
+  case (WTBinOp\<^sub>1 E e\<^sub>1 T\<^sub>1 e\<^sub>2 T\<^sub>2 bop T)
+  then show ?case by(case_tac bop) force+
+next
+  case WTFAcc\<^sub>1 then show ?case
+    by (blast dest:sees_field_idemp sees_field_fun)
+next
+  case WTSFAcc\<^sub>1 then show ?case by (blast dest:sees_field_fun)
+next
+  case WTSFAss\<^sub>1 then show ?case by (blast dest:sees_field_fun)
+next
+  case WTCall\<^sub>1 then show ?case
+    by (blast dest:sees_method_idemp sees_method_fun)
+next
+  case WTSCall\<^sub>1 then show ?case by (blast dest:sees_method_fun)
+qed blast+
 (*>*)
 
 
 lemma assumes wf: "wf_prog p P"
 shows WT\<^sub>1_is_type: "P,E \<turnstile>\<^sub>1 e :: T \<Longrightarrow> set E \<subseteq> types P \<Longrightarrow> is_type P T"
 and "P,E \<turnstile>\<^sub>1 es [::] Ts \<Longrightarrow> True"
 (*<*)
-apply(induct rule:WT\<^sub>1_WTs\<^sub>1.inducts)
-apply simp
-apply simp
-apply (simp add:typeof_lit_is_type)
-apply (blast intro:nth_mem)
-apply(simp split:bop.splits)
-apply simp
-apply (simp add:sees_field_is_type[OF _ wf])
-apply (simp add:sees_field_is_type[OF _ wf])
-apply simp
-apply simp
-apply(fastforce dest!: sees_wf_mdecl[OF wf] simp:wf_mdecl_def)
-apply(fastforce dest!: sees_wf_mdecl[OF wf] simp:wf_mdecl_def)
-apply simp
-apply simp
-apply blast
-apply simp
-apply simp
-apply simp
-apply simp
-apply simp
-done
+proof(induct rule:WT\<^sub>1_WTs\<^sub>1.inducts)
+  case WTVal\<^sub>1 then show ?case by (simp add:typeof_lit_is_type)
+next
+  case WTVar\<^sub>1 then show ?case by (blast intro:nth_mem)
+next
+  case WTBinOp\<^sub>1 then show ?case by (simp split:bop.splits)
+next
+  case WTFAcc\<^sub>1 then show ?case
+    by (simp add:sees_field_is_type[OF _ wf])
+next
+  case WTSFAcc\<^sub>1 then show ?case
+    by (simp add:sees_field_is_type[OF _ wf])
+next
+  case WTCall\<^sub>1 then show ?case
+    by (fastforce dest!: sees_wf_mdecl[OF wf] simp:wf_mdecl_def)
+next
+  case WTSCall\<^sub>1 then show ?case
+    by (fastforce dest!: sees_wf_mdecl[OF wf] simp:wf_mdecl_def)
+next
+  case WTCond\<^sub>1 then show ?case by blast
+qed simp+
 (*>*)
 
 lemma WT\<^sub>1_nsub_RI: "P,E \<turnstile>\<^sub>1 e :: T \<Longrightarrow> \<not>sub_RI e"
  and WTs\<^sub>1_nsub_RIs: "P,E \<turnstile>\<^sub>1 es [::] Ts \<Longrightarrow> \<not>sub_RIs es"
 proof(induct rule: WT\<^sub>1_WTs\<^sub>1.inducts) qed(simp_all)
 
 subsection\<open> Runtime Well-Typedness \<close>
 
 inductive
   WTrt\<^sub>1 :: "J\<^sub>1_prog \<Rightarrow> heap \<Rightarrow> sheap \<Rightarrow> env\<^sub>1 \<Rightarrow> expr\<^sub>1 \<Rightarrow> ty \<Rightarrow> bool"
   and WTrts\<^sub>1 :: "J\<^sub>1_prog \<Rightarrow> heap \<Rightarrow> sheap \<Rightarrow> env\<^sub>1 \<Rightarrow> expr\<^sub>1 list \<Rightarrow> ty list \<Rightarrow> bool"
   and WTrt2\<^sub>1 :: "[J\<^sub>1_prog,env\<^sub>1,heap,sheap,expr\<^sub>1,ty] \<Rightarrow> bool"
         ("_,_,_,_ \<turnstile>\<^sub>1 _ : _"   [51,51,51,51]50)
   and WTrts2\<^sub>1 :: "[J\<^sub>1_prog,env\<^sub>1,heap,sheap,expr\<^sub>1 list, ty list] \<Rightarrow> bool"
         ("_,_,_,_ \<turnstile>\<^sub>1 _ [:] _" [51,51,51,51]50)
   for P :: J\<^sub>1_prog and h :: heap and sh :: sheap
 where
   
   "P,E,h,sh \<turnstile>\<^sub>1 e : T \<equiv> WTrt\<^sub>1 P h sh E e T"
 | "P,E,h,sh \<turnstile>\<^sub>1 es[:]Ts \<equiv> WTrts\<^sub>1 P h sh E es Ts"
 
 | WTrtNew\<^sub>1:
   "is_class P C  \<Longrightarrow>
   P,E,h,sh \<turnstile>\<^sub>1 new C : Class C"
 
 | WTrtCast\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e : T; is_refT T; is_class P C \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 Cast C e : Class C"
 
 | WTrtVal\<^sub>1:
   "typeof\<^bsub>h\<^esub> v = Some T \<Longrightarrow>
   P,E,h,sh \<turnstile>\<^sub>1 Val v : T"
 
 | WTrtVar\<^sub>1:
   "\<lbrakk> E!i = T; i < size E \<rbrakk>  \<Longrightarrow>
   P,E,h,sh \<turnstile>\<^sub>1 Var i : T"
 
 | WTrtBinOpEq\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1 : T\<^sub>1;  P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>2 : T\<^sub>2 \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1 \<guillemotleft>Eq\<guillemotright> e\<^sub>2 : Boolean"
 
 | WTrtBinOpAdd\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1 : Integer;  P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>2 : Integer \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1 \<guillemotleft>Add\<guillemotright> e\<^sub>2 : Integer"
 
 | WTrtLAss\<^sub>1:
   "\<lbrakk> E!i = T; i < size E; P,E,h,sh \<turnstile>\<^sub>1 e : T';  P \<turnstile> T' \<le> T \<rbrakk>
    \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 i:=e : Void"
 
 | WTrtFAcc\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e : Class C; P \<turnstile> C has F,NonStatic:T in D \<rbrakk> \<Longrightarrow>
   P,E,h,sh \<turnstile>\<^sub>1 e\<bullet>F{D} : T"
 
 | WTrtFAccNT\<^sub>1:
   "P,E,h,sh \<turnstile>\<^sub>1 e : NT \<Longrightarrow>
   P,E,h,sh \<turnstile>\<^sub>1 e\<bullet>F{D} : T"
 
 | WTrtSFAcc\<^sub>1:
   "\<lbrakk> P \<turnstile> C has F,Static:T in D \<rbrakk> \<Longrightarrow>
   P,E,h,sh \<turnstile>\<^sub>1 C\<bullet>\<^sub>sF{D} : T"
 
 | WTrtFAss\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1 : Class C;  P \<turnstile> C has F,NonStatic:T in D; P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>2 : T\<^sub>2;  P \<turnstile> T\<^sub>2 \<le> T \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1\<bullet>F{D}:=e\<^sub>2 : Void"
 
 | WTrtFAssNT\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1:NT; P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>2 : T\<^sub>2 \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1\<bullet>F{D}:=e\<^sub>2 : Void"
 
 | WTrtSFAss\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>2 : T\<^sub>2; P \<turnstile> C has F,Static:T in D; P \<turnstile> T\<^sub>2 \<le> T \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 C\<bullet>\<^sub>sF{D}:=e\<^sub>2 : Void"
 
 | WTrtCall\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e : Class C; P \<turnstile> C sees M,NonStatic:Ts \<rightarrow> T = m in D;
      P,E,h,sh \<turnstile>\<^sub>1 es [:] Ts'; P \<turnstile> Ts' [\<le>] Ts \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 e\<bullet>M(es) : T"
 
 | WTrtCallNT\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e : NT; P,E,h,sh \<turnstile>\<^sub>1 es [:] Ts \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 e\<bullet>M(es) : T"
 
 | WTrtSCall\<^sub>1:
   "\<lbrakk> P \<turnstile> C sees M,Static:Ts \<rightarrow> T = m in D;
      P,E,h,sh \<turnstile>\<^sub>1 es [:] Ts'; P \<turnstile> Ts' [\<le>] Ts;
      M = clinit \<longrightarrow> sh D = \<lfloor>(sfs,Processing)\<rfloor> \<and> es = map Val vs \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 C\<bullet>\<^sub>sM(es) : T"
 
 | WTrtBlock\<^sub>1:
   "P,E@[T],h,sh \<turnstile>\<^sub>1 e : T'  \<Longrightarrow>
   P,E,h,sh \<turnstile>\<^sub>1 {i:T; e} : T'"
 
 | WTrtSeq\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1:T\<^sub>1;  P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>2:T\<^sub>2 \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1;;e\<^sub>2 : T\<^sub>2"
 
 | WTrtCond\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e : Boolean;  P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1:T\<^sub>1;  P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>2:T\<^sub>2;
      P \<turnstile> T\<^sub>1 \<le> T\<^sub>2 \<or> P \<turnstile> T\<^sub>2 \<le> T\<^sub>1; P \<turnstile> T\<^sub>1 \<le> T\<^sub>2 \<longrightarrow> T = T\<^sub>2; P \<turnstile> T\<^sub>2 \<le> T\<^sub>1 \<longrightarrow> T = T\<^sub>1 \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 if (e) e\<^sub>1 else e\<^sub>2 : T"
 
 | WTrtWhile\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e : Boolean;  P,E,h,sh \<turnstile>\<^sub>1 c:T \<rbrakk>
   \<Longrightarrow>  P,E,h,sh \<turnstile>\<^sub>1 while(e) c : Void"
 
 | WTrtThrow\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e : T\<^sub>r; is_refT T\<^sub>r \<rbrakk> \<Longrightarrow>
   P,E,h,sh \<turnstile>\<^sub>1 throw e : T"
 
 | WTrtTry\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1 : T\<^sub>1;  P,E@[Class C],h,sh \<turnstile>\<^sub>1 e\<^sub>2 : T\<^sub>2; P \<turnstile> T\<^sub>1 \<le> T\<^sub>2 \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 try e\<^sub>1 catch(C i) e\<^sub>2 : T\<^sub>2"
 
 | WTrtInit\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e : T; \<forall>C' \<in> set (C#Cs). is_class P C'; \<not>sub_RI e;
      \<forall>C' \<in> set (tl Cs). \<exists>sfs. sh C' = \<lfloor>(sfs,Processing)\<rfloor>;
      b \<longrightarrow> (\<forall>C' \<in> set Cs. \<exists>sfs. sh C' = \<lfloor>(sfs,Processing)\<rfloor>);
      distinct Cs; supercls_lst P Cs \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 INIT C (Cs, b) \<leftarrow> e : T"
 
 | WTrtRI\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e : T; P,E,h,sh \<turnstile>\<^sub>1 e' : T'; \<forall>C' \<in> set (C#Cs). is_class P C'; \<not>sub_RI e';
      \<forall>C' \<in> set (C#Cs). not_init C' e;
      \<forall>C' \<in> set Cs. \<exists>sfs. sh C' = \<lfloor>(sfs,Processing)\<rfloor>;
      \<exists>sfs. sh C = \<lfloor>(sfs, Processing)\<rfloor> \<or> (sh C = \<lfloor>(sfs, Error)\<rfloor> \<and> e = THROW NoClassDefFoundError);
      distinct (C#Cs); supercls_lst P (C#Cs) \<rbrakk>
   \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 RI(C, e);Cs \<leftarrow> e' : T'"
 
 \<comment> \<open>well-typed expression lists\<close>
 
 | WTrtNil\<^sub>1:
   "P,E,h,sh \<turnstile>\<^sub>1 [] [:] []"
 
 | WTrtCons\<^sub>1:
   "\<lbrakk> P,E,h,sh \<turnstile>\<^sub>1 e : T;  P,E,h,sh \<turnstile>\<^sub>1 es [:] Ts \<rbrakk>
   \<Longrightarrow>  P,E,h,sh \<turnstile>\<^sub>1 e#es [:] T#Ts"
 
 (*<*)
 declare WTrt\<^sub>1_WTrts\<^sub>1.intros[intro!] WTrtNil\<^sub>1[iff]
 declare
   WTrtFAcc\<^sub>1[rule del] WTrtFAccNT\<^sub>1[rule del] WTrtSFAcc\<^sub>1[rule del]
   WTrtFAss\<^sub>1[rule del] WTrtFAssNT\<^sub>1[rule del] WTrtSFAss\<^sub>1[rule del]
   WTrtCall\<^sub>1[rule del] WTrtCallNT\<^sub>1[rule del] WTrtSCall\<^sub>1[rule del]
 
 lemmas WTrt\<^sub>1_induct = WTrt\<^sub>1_WTrts\<^sub>1.induct [split_format (complete)]
   and WTrt\<^sub>1_inducts = WTrt\<^sub>1_WTrts\<^sub>1.inducts [split_format (complete)]
 (*>*)
 
 (*<*)
 inductive_cases WTrt\<^sub>1_elim_cases[elim!]:
   "P,E,h,sh \<turnstile>\<^sub>1 Val v : T"
   "P,E,h,sh \<turnstile>\<^sub>1 Var i : T"
   "P,E,h,sh \<turnstile>\<^sub>1 v :=e : T"
   "P,E,h,sh \<turnstile>\<^sub>1 {i:U; e} : T"
   "P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1;;e\<^sub>2 : T\<^sub>2"
   "P,E,h,sh \<turnstile>\<^sub>1 if (e) e\<^sub>1 else e\<^sub>2 : T"
   "P,E,h,sh \<turnstile>\<^sub>1 while(e) c : T"
   "P,E,h,sh \<turnstile>\<^sub>1 throw e : T"
   "P,E,h,sh \<turnstile>\<^sub>1 try e\<^sub>1 catch(C V) e\<^sub>2 : T"
   "P,E,h,sh \<turnstile>\<^sub>1 Cast D e : T"
   "P,E,h,sh \<turnstile>\<^sub>1 e\<bullet>F{D} : T"
   "P,E,h,sh \<turnstile>\<^sub>1 C\<bullet>\<^sub>sF{D} : T"
   "P,E,h,sh \<turnstile>\<^sub>1 e\<bullet>F{D} := v : T"
   "P,E,h,sh \<turnstile>\<^sub>1 C\<bullet>\<^sub>sF{D} := v : T"
   "P,E,h,sh \<turnstile>\<^sub>1 e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2 : T"
   "P,E,h,sh \<turnstile>\<^sub>1 new C : T"
   "P,E,h,sh \<turnstile>\<^sub>1 e\<bullet>M{D}(es) : T"
   "P,E,h,sh \<turnstile>\<^sub>1 C\<bullet>\<^sub>sM{D}(es) : T"
   "P,E,h,sh \<turnstile>\<^sub>1 INIT C (Cs,b) \<leftarrow> e : T"
   "P,E,h,sh \<turnstile>\<^sub>1 RI(C,e);Cs \<leftarrow> e' : T"
   "P,E,h,sh \<turnstile>\<^sub>1 [] [:] Ts"
   "P,E,h,sh \<turnstile>\<^sub>1 e#es [:] Ts"
 (*>*)
 
 lemma WT\<^sub>1_implies_WTrt\<^sub>1: "P,E \<turnstile>\<^sub>1 e :: T \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 e : T"
 and WTs\<^sub>1_implies_WTrts\<^sub>1: "P,E \<turnstile>\<^sub>1 es [::] Ts \<Longrightarrow> P,E,h,sh \<turnstile>\<^sub>1 es [:] Ts"
 (*<*)
-apply(induct rule: WT\<^sub>1_WTs\<^sub>1_inducts)
-apply fast
-apply (fast)
-apply(fastforce dest:typeof_lit_typeof)
-apply(fast)
-apply(rename_tac E e\<^sub>1 T\<^sub>1 e\<^sub>2 T\<^sub>2 bop T) apply(case_tac bop)
- apply(fastforce)
- apply(fastforce)
-apply(fastforce)
-apply(meson WTrtFAcc\<^sub>1 has_visible_field)
-apply(meson WTrtSFAcc\<^sub>1 has_visible_field)
-apply(meson WTrtFAss\<^sub>1 has_visible_field)
-apply(meson WTrtSFAss\<^sub>1 has_visible_field)
-apply(fastforce simp: WTrtCall\<^sub>1)
-apply(fastforce simp: WTrtSCall\<^sub>1)
-apply(fastforce)
-apply(fastforce)
-apply(fastforce simp: WTrtCond\<^sub>1)
-apply(fastforce)
-apply(fastforce)
-apply(fastforce)
-apply(simp)
-apply(fast)
-done
+proof(induct rule: WT\<^sub>1_WTs\<^sub>1_inducts)
+  case WTVal\<^sub>1 then show ?case by (fastforce dest:typeof_lit_typeof)
+next
+  case (WTBinOp\<^sub>1 E e\<^sub>1 T\<^sub>1 e\<^sub>2 T\<^sub>2 bop T)
+  then show ?case by (case_tac bop) fastforce+
+next
+  case WTFAcc\<^sub>1 then show ?case
+    by (fastforce simp: WTrtFAcc\<^sub>1 has_visible_field)
+next
+  case WTSFAcc\<^sub>1 then show ?case
+    by (fastforce simp: WTrtSFAcc\<^sub>1 has_visible_field)
+next
+  case WTFAss\<^sub>1 then show ?case by (meson WTrtFAss\<^sub>1 has_visible_field)
+next
+  case WTSFAss\<^sub>1 then show ?case by (meson WTrtSFAss\<^sub>1 has_visible_field)
+next
+  case WTCall\<^sub>1 then show ?case by (fastforce simp: WTrtCall\<^sub>1)
+next
+  case WTSCall\<^sub>1 then show ?case by (fastforce simp: WTrtSCall\<^sub>1)
+qed fastforce+
 (*>*)
 
 subsection\<open> Well-formedness\<close>
 
 \<comment> \<open>Indices in blocks increase by 1\<close>
 
 primrec \<B> :: "expr\<^sub>1 \<Rightarrow> nat \<Rightarrow> bool"
   and \<B>s :: "expr\<^sub>1 list \<Rightarrow> nat \<Rightarrow> bool" where
 "\<B> (new C) i = True" |
 "\<B> (Cast C e) i = \<B> e i" |
 "\<B> (Val v) i = True" |
 "\<B> (e\<^sub>1 \<guillemotleft>bop\<guillemotright> e\<^sub>2) i = (\<B> e\<^sub>1 i \<and> \<B> e\<^sub>2 i)" |
 "\<B> (Var j) i = True" |
 "\<B> (e\<bullet>F{D}) i = \<B> e i" |
 "\<B> (C\<bullet>\<^sub>sF{D}) i = True" |
 "\<B> (j:=e) i = \<B> e i" |
 "\<B> (e\<^sub>1\<bullet>F{D} := e\<^sub>2) i = (\<B> e\<^sub>1 i \<and> \<B> e\<^sub>2 i)" |
 "\<B> (C\<bullet>\<^sub>sF{D} := e\<^sub>2) i = \<B> e\<^sub>2 i" |
 "\<B> (e\<bullet>M(es)) i = (\<B> e i \<and> \<B>s es i)" |
 "\<B> (C\<bullet>\<^sub>sM(es)) i = \<B>s es i" |
 "\<B> ({j:T ; e}) i = (i = j \<and> \<B> e (i+1))" |
 "\<B> (e\<^sub>1;;e\<^sub>2) i = (\<B> e\<^sub>1 i \<and> \<B> e\<^sub>2 i)" |
 "\<B> (if (e) e\<^sub>1 else e\<^sub>2) i = (\<B> e i \<and> \<B> e\<^sub>1 i \<and> \<B> e\<^sub>2 i)" |
 "\<B> (throw e) i = \<B> e i" |
 "\<B> (while (e) c) i = (\<B> e i \<and> \<B> c i)" |
 "\<B> (try e\<^sub>1 catch(C j) e\<^sub>2) i = (\<B> e\<^sub>1 i \<and> i=j \<and> \<B> e\<^sub>2 (i+1))" |
 "\<B> (INIT C (Cs,b) \<leftarrow> e) i = \<B> e i" |
 "\<B> (RI(C,e);Cs \<leftarrow> e') i = (\<B> e i \<and> \<B> e' i)" |
 
 "\<B>s [] i = True" |
 "\<B>s (e#es) i = (\<B> e i \<and> \<B>s es i)"
 
 
 definition wf_J\<^sub>1_mdecl :: "J\<^sub>1_prog \<Rightarrow> cname \<Rightarrow> expr\<^sub>1 mdecl \<Rightarrow> bool"
 where
   "wf_J\<^sub>1_mdecl P C  \<equiv>  \<lambda>(M,b,Ts,T,body).
     \<not>sub_RI body \<and>
  (case b of
     NonStatic \<Rightarrow>
         (\<exists>T'. P,Class C#Ts \<turnstile>\<^sub>1 body :: T' \<and> P \<turnstile> T' \<le> T) \<and>
         \<D> body \<lfloor>{..size Ts}\<rfloor> \<and> \<B> body (size Ts + 1)
   | Static \<Rightarrow> (\<exists>T'. P,Ts \<turnstile>\<^sub>1 body :: T' \<and> P \<turnstile> T' \<le> T) \<and>
         \<D> body \<lfloor>{..<size Ts}\<rfloor> \<and> \<B> body (size Ts))"
 
 lemma wf_J\<^sub>1_mdecl_NonStatic[simp]:
   "wf_J\<^sub>1_mdecl P C (M,NonStatic,Ts,T,body) \<equiv>
     (\<not>sub_RI body \<and>
     (\<exists>T'. P,Class C#Ts \<turnstile>\<^sub>1 body :: T' \<and> P \<turnstile> T' \<le> T) \<and>
      \<D> body \<lfloor>{..size Ts}\<rfloor> \<and> \<B> body (size Ts + 1))"
 (*<*)by (simp add:wf_J\<^sub>1_mdecl_def)(*>*)
 
 lemma wf_J\<^sub>1_mdecl_Static[simp]:
   "wf_J\<^sub>1_mdecl P C (M,Static,Ts,T,body) \<equiv>
     (\<not>sub_RI body \<and>
     (\<exists>T'. P,Ts \<turnstile>\<^sub>1 body :: T' \<and> P \<turnstile> T' \<le> T) \<and>
      \<D> body \<lfloor>{..<size Ts}\<rfloor> \<and> \<B> body (size Ts))"
 (*<*)by (simp add:wf_J\<^sub>1_mdecl_def)(*>*)
 
 abbreviation "wf_J\<^sub>1_prog == wf_prog wf_J\<^sub>1_mdecl"
 
 lemma sees_wf\<^sub>1_nsub_RI:
- "\<lbrakk> wf_J\<^sub>1_prog P; P \<turnstile> C sees M,b : Ts\<rightarrow>T = body in D \<rbrakk> \<Longrightarrow> \<not>sub_RI body"
-apply(drule sees_wf_mdecl, simp)
-apply(unfold wf_J\<^sub>1_mdecl_def wf_mdecl_def, simp)
-done
+assumes wf: "wf_J\<^sub>1_prog P" and cM: "P \<turnstile> C sees M,b : Ts\<rightarrow>T = body in D"
+shows "\<not>sub_RI body"
+using sees_wf_mdecl[OF wf cM] by(simp add: wf_J\<^sub>1_mdecl_def wf_mdecl_def)
 
 lemma wf\<^sub>1_types_clinit:
 assumes wf:"wf_prog wf_md P" and ex: "class P C = Some a" and proc: "sh C = \<lfloor>(sfs, Processing)\<rfloor>"
 shows "P,E,h,sh \<turnstile>\<^sub>1 C\<bullet>\<^sub>sclinit([]) : Void"
 proof -
   from ex obtain D fs ms where "a = (D,fs,ms)" by(cases a)
   then have sP: "(C, D, fs, ms) \<in> set P" using ex map_of_SomeD[of P C a] by(simp add: class_def)
   then have "wf_clinit ms" using assms by(unfold wf_prog_def wf_cdecl_def, auto)
   then obtain m where sm: "(clinit, Static, [], Void, m) \<in> set ms"
     by(unfold wf_clinit_def) auto
   then have "P \<turnstile> C sees clinit,Static:[] \<rightarrow> Void = m in C"
     using mdecl_visible[OF wf sP sm] by simp
   then show ?thesis using WTrtSCall\<^sub>1 proc by blast
 qed
 
 
 lemma assumes wf: "wf_J\<^sub>1_prog P"
 shows eval\<^sub>1_proc_pres: "P \<turnstile>\<^sub>1 \<langle>e,(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',(h',l',sh')\<rangle>
   \<Longrightarrow> not_init C e \<Longrightarrow> \<exists>sfs. sh C = \<lfloor>(sfs, Processing)\<rfloor> \<Longrightarrow> \<exists>sfs'. sh' C = \<lfloor>(sfs', Processing)\<rfloor>"
   and evals\<^sub>1_proc_pres: "P \<turnstile>\<^sub>1 \<langle>es,(h,l,sh)\<rangle> [\<Rightarrow>] \<langle>es',(h',l',sh')\<rangle>
   \<Longrightarrow> not_inits C es \<Longrightarrow> \<exists>sfs. sh C = \<lfloor>(sfs, Processing)\<rfloor> \<Longrightarrow> \<exists>sfs'. sh' C = \<lfloor>(sfs', Processing)\<rfloor>"
 (*<*)
 proof(induct rule:eval\<^sub>1_evals\<^sub>1_inducts)
   case Call\<^sub>1 then show ?case using sees_wf\<^sub>1_nsub_RI[OF wf Call\<^sub>1.hyps(6)] nsub_RI_not_init by auto
 next
   case (SCallInit\<^sub>1 ps h l sh vs h\<^sub>1 l\<^sub>1 sh\<^sub>1 C' M Ts T body D v' h\<^sub>2 l\<^sub>2 sh\<^sub>2 l\<^sub>2' e' h\<^sub>3 l\<^sub>3 sh\<^sub>3)
   then show ?case
     using SCallInit\<^sub>1 sees_wf\<^sub>1_nsub_RI[OF wf SCallInit\<^sub>1.hyps(3)] nsub_RI_not_init[of body] by auto
 next
   case SCall\<^sub>1 then show ?case using sees_wf\<^sub>1_nsub_RI[OF wf SCall\<^sub>1.hyps(3)] nsub_RI_not_init by auto
 next
   case (InitNone\<^sub>1 sh C1 C' Cs h l e' a a b) then show ?case by(cases "C = C1") auto
 next
   case (InitDone\<^sub>1 sh C sfs C' Cs h l e' a a b) then show ?case by(cases Cs, auto)
 next
   case (InitProcessing\<^sub>1 sh C sfs C' Cs h l e' a a b) then show ?case by(cases Cs, auto)
 next
   case (InitError\<^sub>1 sh C1 sfs Cs h l e' a a b C') then show ?case by(cases "C = C1") auto
 next
   case (InitObject\<^sub>1 sh C1 sfs sh' C' Cs h l e' a a b) then show ?case by(cases "C = C1") auto
 next
   case (InitNonObject\<^sub>1 sh C1 sfs D a b sh' C' Cs h l e' a a b)
   then show ?case by(cases "C = C1") auto
 next
   case (RInit\<^sub>1 e a a b v h' l' sh' C sfs i sh'' C' Cs e\<^sub>1 a a b) then show ?case by(cases Cs, auto)
 next
   case (RInitInitFail\<^sub>1 e h l sh a h' l' sh' C1 sfs i sh'' D Cs e\<^sub>1 h1 l1 sh1)
   then show ?case using eval\<^sub>1_final by fastforce
 qed(auto)
+(*>*)
 
 lemma clinit\<^sub>1_proc_pres:
   "\<lbrakk> wf_J\<^sub>1_prog P; P \<turnstile>\<^sub>1 \<langle>C\<^sub>0\<bullet>\<^sub>sclinit([]),(h,l,sh)\<rangle> \<Rightarrow> \<langle>e',(h',l',sh')\<rangle>;
      sh C' = \<lfloor>(sfs,Processing)\<rfloor> \<rbrakk>
   \<Longrightarrow> \<exists>sfs. sh' C' = \<lfloor>(sfs,Processing)\<rfloor>"
  by(auto dest: eval\<^sub>1_proc_pres)
 
 end
diff --git a/thys/JinjaDCI/Compiler/PCompiler.thy b/thys/JinjaDCI/Compiler/PCompiler.thy
--- a/thys/JinjaDCI/Compiler/PCompiler.thy
+++ b/thys/JinjaDCI/Compiler/PCompiler.thy
@@ -1,314 +1,393 @@
 (*  Title:      JinjaDCI/Compiler/PCompiler.thy
 
     Author:     Tobias Nipkow, Susannah Mansky
     Copyright   TUM 2003, UIUC 2019-20
 
     Based on the Jinja theory Common/PCompiler.thy by Tobias Nipkow
 *)
 
 section \<open> Program Compilation \<close>
 
 theory PCompiler
 imports "../Common/WellForm"
 begin
 
 definition compM :: "(staticb \<Rightarrow> 'a \<Rightarrow> 'b) \<Rightarrow> 'a mdecl \<Rightarrow> 'b mdecl"
 where
   "compM f  \<equiv>  \<lambda>(M, b, Ts, T, m). (M, b, Ts, T, f b m)"
 
 definition compC :: "(staticb \<Rightarrow> 'a \<Rightarrow> 'b) \<Rightarrow> 'a cdecl \<Rightarrow> 'b cdecl"
 where
   "compC f  \<equiv>  \<lambda>(C,D,Fdecls,Mdecls). (C,D,Fdecls, map (compM f) Mdecls)"
 
 definition compP :: "(staticb \<Rightarrow> 'a \<Rightarrow> 'b) \<Rightarrow> 'a prog \<Rightarrow> 'b prog"
 where
   "compP f  \<equiv>  map (compC f)"
 
 text\<open> Compilation preserves the program structure.  Therefore lookup
 functions either commute with compilation (like method lookup) or are
 preserved by it (like the subclass relation). \<close>
 
 lemma map_of_map4:
   "map_of (map (\<lambda>(x,a,b,c).(x,a,b,f c)) ts) =
   map_option (\<lambda>(a,b,c).(a,b,f c)) \<circ> (map_of ts)"
 (*<*)
-apply(induct ts)
- apply simp
-apply(rule ext)
-apply fastforce
-done
+proof(induct ts)
+  case Nil then show ?case by simp
+qed fastforce
 (*>*)
 
 lemma map_of_map245:
   "map_of (map (\<lambda>(x,a,b,c,d).(x,a,b,c,f a c d)) ts) =
   map_option (\<lambda>(a,b,c,d).(a,b,c,f a c d)) \<circ> (map_of ts)"
 (*<*)
-apply(induct ts)
- apply simp
-apply(rule ext)
-apply fastforce
-done
+proof(induct ts)
+  case Nil then show ?case by simp
+qed fastforce
 (*>*)
 
 
 lemma class_compP:
   "class P C = Some (D, fs, ms)
   \<Longrightarrow> class (compP f P) C = Some (D, fs, map (compM f) ms)"
 (*<*)by(simp add:class_def compP_def compC_def map_of_map4)(*>*)
 
 
 lemma class_compPD:
   "class (compP f P) C = Some (D, fs, cms)
   \<Longrightarrow> \<exists>ms. class P C = Some(D,fs,ms) \<and> cms = map (compM f) ms"
 (*<*)by(clarsimp simp add:class_def compP_def compC_def map_of_map4)(*>*)
 
 
 lemma [simp]: "is_class (compP f P) C = is_class P C"
 (*<*)by(auto simp:is_class_def dest: class_compP class_compPD)(*>*)
 
 
 lemma [simp]: "class (compP f P) C = map_option (\<lambda>c. snd(compC f (C,c))) (class P C)"
 (*<*)
-apply(simp add:compP_def compC_def class_def map_of_map4)
-apply(simp add:split_def)
-done
+by(simp add:compP_def compC_def class_def map_of_map4)
+  (simp add:split_def)
 (*>*)
 
 
 lemma sees_methods_compP:
   "P \<turnstile> C sees_methods Mm \<Longrightarrow>
   compP f P \<turnstile> C sees_methods (map_option (\<lambda>((b,Ts,T,m),D). ((b,Ts,T,f b m),D)) \<circ> Mm)"
-(*<*)
-apply(erule Methods.induct)
- apply(rule sees_methods_Object)
-  apply(erule class_compP)
- apply(rule ext)
- apply(simp add:compM_def map_of_map245 option.map_comp)
- apply(case_tac "map_of ms x")
-  apply simp
- apply fastforce
-apply(rule sees_methods_rec)
-   apply(erule class_compP)
-  apply assumption
- apply assumption
-apply(rule ext)
-apply(simp add:map_add_def compM_def map_of_map245 option.map_comp split:option.split)
-done
+(*<*)(is "?P \<Longrightarrow> compP f P \<turnstile> C sees_methods (?map Mm)")
+proof(induct rule: Methods.induct)
+  case Object: (sees_methods_Object D fs ms Mm)
+  let ?Mm1 = "\<lambda>x. map_option ((\<lambda>m. (m, Object)) \<circ> (\<lambda>(b, Ts, T, m). (b, Ts, T, f b m))) (map_of ms x)"
+  let ?Mm2 = "\<lambda>x. map_option (case_prod (\<lambda>(b, Ts, T, m).
+                   Pair (b, Ts, T, f b m)) \<circ> (\<lambda>m. (m, Object))) (map_of ms x)"
+  have Mm_eq: "\<And>x. ?Mm1 x = ?Mm2 x"
+  proof -
+    fix x show "?Mm1 x = ?Mm2 x"
+    proof(cases "map_of ms x")
+      case None then show ?thesis by simp
+    qed fastforce
+  qed
+
+  have Mm: "Mm = map_option (\<lambda>m. (m, Object)) \<circ> map_of ms" by fact
+  let ?Mm = "map_option (\<lambda>m. (m, Object)) \<circ> map_of (map (compM f) ms)"
+  let ?Mm' = "?map Mm"
+  have "?Mm' = ?Mm"
+    by(rule ext) (simp add:Mm Mm_eq compM_def map_of_map245 option.map_comp)
+  then show ?case by(rule sees_methods_Object[OF class_compP[OF Object(1)]])
+next
+  case rec: (sees_methods_rec C D fs ms Mm Mm')
+  have Mm': "Mm' = Mm ++ (map_option (\<lambda>m. (m, C)) \<circ> map_of ms)" by fact
+  let ?Mm' = "?map Mm'"
+  let ?Mm'' = "(?map Mm) ++ (map_option (\<lambda>m. (m, C)) \<circ> map_of (map (compM f) ms))"
+  have "?Mm' = ?Mm''"
+    by(rule ext) (simp add:Mm' map_add_def compM_def map_of_map245)
+  moreover have "compP f P \<turnstile> C sees_methods ?Mm''"
+    using sees_methods_rec[OF class_compP[OF rec(1)] rec(2,4)] by fast
+  ultimately show "compP f P \<turnstile> C sees_methods ?Mm'" by simp
+qed
 (*>*)
 
 
 lemma sees_method_compP:
   "P \<turnstile> C sees M,b: Ts\<rightarrow>T = m in D \<Longrightarrow>
   compP f P \<turnstile> C sees M,b: Ts\<rightarrow>T = (f b m) in D"
 (*<*)by(fastforce elim:sees_methods_compP simp add:Method_def)(*>*)
 
 
 lemma [simp]:
   "P \<turnstile> C sees M,b: Ts\<rightarrow>T = m in D \<Longrightarrow>
   method (compP f P) C M = (D,b,Ts,T,f b m)"
 (*<*)
-apply(drule sees_method_compP)
-apply(simp add:method_def)
-apply(rule the_equality)
- apply simp
-apply(fastforce dest:sees_method_fun)
-done
+proof -
+  let ?P = "\<lambda>(D, b, Ts, T, m). compP f P \<turnstile> C sees M, b :  Ts\<rightarrow>T = m in D"
+  let ?a = "(D, b, Ts, T, f b m)"
+  assume cM: "P \<turnstile> C sees M,b: Ts\<rightarrow>T = m in D"
+  have compP_cM: "?P ?a" using sees_method_compP[OF cM] by simp
+  moreover {
+    fix x assume "?P x" then have "x = ?a"
+      using compP_cM by(fastforce dest:sees_method_fun)
+  }
+  ultimately have "(THE x. ?P x) = ?a" by(rule the_equality)
+  then show ?thesis by(simp add:method_def)
+qed
 (*>*)
 
 
 lemma sees_methods_compPD:
   "\<lbrakk> cP \<turnstile> C sees_methods Mm'; cP = compP f P \<rbrakk> \<Longrightarrow>
   \<exists>Mm. P \<turnstile> C sees_methods Mm \<and>
         Mm' = (map_option (\<lambda>((b,Ts,T,m),D). ((b,Ts,T,f b m),D)) \<circ> Mm)"
-(*<*)
-apply(erule Methods.induct)
- apply(clarsimp simp:compC_def)
- apply(rule exI)
- apply(rule conjI, erule sees_methods_Object)
-  apply(rule refl)
- apply(rule ext)
- apply(simp add:compM_def map_of_map245 option.map_comp)
- apply(case_tac "map_of b x")
-  apply simp
- apply fastforce
-apply(clarsimp simp:compC_def)
-apply(rule exI, rule conjI)
- apply(erule (2) sees_methods_rec)
- apply(rule refl)
-apply(rule ext)
-apply(simp add:map_add_def compM_def map_of_map245 option.map_comp split:option.split)
-done
+(*<*)(is "\<lbrakk> ?P; ?Q \<rbrakk> \<Longrightarrow> \<exists>Mm. P \<turnstile> C sees_methods Mm \<and> Mm' = (?map Mm)")
+proof(induct rule: Methods.induct)
+  case Object: (sees_methods_Object D fs ms Mm)
+  then obtain ms' where P_Obj: "class P Object = \<lfloor>(D, fs, ms')\<rfloor>"
+    and ms: "ms = map (compM f) ms'" by(clarsimp simp:compC_def)
+
+  let ?Mm1 = "\<lambda>x. map_option ((\<lambda>m. (m, Object)) \<circ> (\<lambda>(b, Ts, T, m). (b, Ts, T, f b m))) (map_of ms' x)"
+  let ?Mm2 = "\<lambda>x. map_option (case_prod (\<lambda>(b, Ts, T, m). Pair (b, Ts, T, f b m)) \<circ> (\<lambda>m. (m, Object)))
+          (map_of ms' x)"
+  have Mm_eq: "\<And>x. ?Mm1 x = ?Mm2 x"
+  proof -
+    fix x show "?Mm1 x = ?Mm2 x"
+    proof(cases "map_of ms' x")
+      case None then show ?thesis by simp
+    qed fastforce
+  qed
+
+  let ?Mm = "map_option (\<lambda>m. (m,Object)) \<circ> map_of ms'"
+  let ?Mm' = "?map ?Mm"
+  have Mm: "Mm = map_option (\<lambda>m. (m, Object)) \<circ> map_of ms" by fact
+  have "P \<turnstile> Object sees_methods ?Mm"
+    using sees_methods_Object[OF P_Obj] by simp
+  moreover have "Mm = ?Mm'"
+    by(rule ext) (simp add:Mm_eq Mm ms compM_def map_of_map245 option.map_comp)
+  ultimately show ?case by fast
+next
+  case rec: (sees_methods_rec C D fs ms Mm Mm')
+  then obtain ms' Mm\<^sub>D where P_D: "class P C = \<lfloor>(D, fs, ms')\<rfloor>"
+     and ms: "ms = map (compM f) ms'" and C_nObj: "C \<noteq> Object"
+     and Mm\<^sub>D: "P \<turnstile> D sees_methods Mm\<^sub>D"
+     and Mm: "Mm = (\<lambda>a. map_option (case_prod (\<lambda>(b, Ts, T, m). Pair (b, Ts, T, f b m))) (Mm\<^sub>D a))"
+    by(clarsimp simp:compC_def)
+
+  let ?Mm = "Mm\<^sub>D ++ (map_option (\<lambda>m. (m, C)) \<circ> map_of ms')"
+  let ?Mm1 = "Mm ++ (map_option (\<lambda>m. (m, C)) \<circ> map_of ms)"
+  let ?Mm2 = "Mm ++ (map_option (\<lambda>m. (m, C)) \<circ> map_of (map (compM f) ms'))"
+  let ?Mm3 = "?map ?Mm"
+  have "Mm' = ?Mm1" by fact
+  also have "\<dots> = ?Mm2" using ms by simp
+  also have "\<dots> = ?Mm3"
+    by(rule ext)(simp add:Mm map_add_def compM_def map_of_map245)
+  moreover have "P \<turnstile> C sees_methods ?Mm"
+    using sees_methods_rec[OF P_D C_nObj Mm\<^sub>D] by simp
+  ultimately show ?case by fast
+qed
 (*>*)
 
 
 lemma sees_method_compPD:
   "compP f P \<turnstile> C sees M,b: Ts\<rightarrow>T = fm in D \<Longrightarrow>
   \<exists>m. P \<turnstile> C sees M,b: Ts\<rightarrow>T = m in D \<and> f b m = fm"
 (*<*)
-apply(simp add:Method_def)
-apply clarify
-apply(drule sees_methods_compPD[OF _ refl])
-apply clarsimp
-apply blast
-done
+proof -
+  assume "compP f P \<turnstile> C sees M,b: Ts\<rightarrow>T = fm in D"
+  then obtain Mm where Mm: "compP f P \<turnstile> C sees_methods Mm"
+     and MmM: "Mm M = \<lfloor>((b, Ts, T, fm), D)\<rfloor>"
+    by(clarsimp simp:Method_def)
+  show ?thesis using sees_methods_compPD[OF Mm refl] MmM
+    by(fastforce simp: Method_def)
+qed
 (*>*)
 
 
 lemma [simp]: "subcls1(compP f P) = subcls1 P"
 (*<*)
 by(fastforce simp add: is_class_def compC_def intro:subcls1I order_antisym dest:subcls1D)
 (*>*)
 
 
 lemma compP_widen[simp]: "(compP f P \<turnstile> T \<le> T') = (P \<turnstile> T \<le> T')"
 (*<*)by(cases T')(simp_all add:widen_Class)(*>*)
 
 
 lemma [simp]: "(compP f P \<turnstile> Ts [\<le>] Ts') = (P \<turnstile> Ts [\<le>] Ts')"
 (*<*)
-apply(induct Ts)
- apply simp
-apply(cases Ts')
- apply(auto simp:fun_of_def)
-done
+proof(induct Ts)
+  case (Cons a Ts)
+  then show ?case by(cases Ts')(auto simp:fun_of_def)
+qed simp
 (*>*)
 
 
 lemma [simp]: "is_type (compP f P) T = is_type P T"
 (*<*)by(cases T) simp_all(*>*)
 
 
 lemma [simp]: "(compP (f::staticb\<Rightarrow>'a\<Rightarrow>'b) P \<turnstile> C has_fields FDTs) = (P \<turnstile> C has_fields FDTs)"
 (*<*)
  (is "?A = ?B")
 proof
   { fix cP::"'b prog" assume "cP \<turnstile> C has_fields FDTs"
     hence "cP = compP f P \<Longrightarrow> P \<turnstile> C has_fields FDTs"
     proof induct
       case has_fields_Object
       thus ?case by(fast intro:Fields.has_fields_Object dest:class_compPD)
     next
       case has_fields_rec
       thus ?case by(fast intro:Fields.has_fields_rec dest:class_compPD)
     qed
   } note lem = this
   assume ?A
   with lem show ?B by blast
 next
   assume ?B
   thus ?A
   proof induct
     case has_fields_Object
     thus ?case by(fast intro:Fields.has_fields_Object class_compP)
   next
     case has_fields_rec
     thus ?case by(fast intro:Fields.has_fields_rec class_compP)
   qed
 qed
 (*>*)
 
 
 lemma fields_compP [simp]: "fields (compP f P) C = fields P C"
 (*<*)by(simp add:fields_def)(*>*)
 
 lemma ifields_compP [simp]: "ifields (compP f P) C = ifields P C"
 (*<*)by(simp add:ifields_def)(*>*)
 
 lemma blank_compP [simp]: "blank (compP f P) C = blank P C"
 (*<*)by(simp add:blank_def)(*>*)
 
 lemma isfields_compP [simp]: "isfields (compP f P) C = isfields P C"
 (*<*)by(simp add:isfields_def)(*>*)
 
 lemma sblank_compP [simp]: "sblank (compP f P) C = sblank P C"
 (*<*)by(simp add:sblank_def)(*>*)
 
 lemma sees_fields_compP [simp]: "(compP f P \<turnstile> C sees F,b:T in D) = (P \<turnstile> C sees F,b:T in D)"
 (*<*)by(simp add:sees_field_def)(*>*)
 
 lemma has_field_compP [simp]: "(compP f P \<turnstile> C has F,b:T in D) = (P \<turnstile> C has F,b:T in D)"
 (*<*)by(simp add:has_field_def)(*>*)
 
 lemma field_compP [simp]: "field (compP f P) F D = field P F D"
 (*<*)by(simp add:field_def)(*>*)
 
 
 subsection\<open>Invariance of @{term wf_prog} under compilation \<close>
 
 lemma [iff]: "distinct_fst (compP f P) = distinct_fst P"
 (*<*)
-apply(simp add:distinct_fst_def compP_def compC_def)
-apply(induct P)
-apply (auto simp:image_iff)
-done
+by (induct P)
+   (auto simp:distinct_fst_def compP_def compC_def image_iff)
 (*>*)
 
 
 lemma [iff]: "distinct_fst (map (compM f) ms) = distinct_fst ms"
 (*<*)
-apply(simp add:distinct_fst_def compM_def)
-apply(induct ms)
-apply (auto simp:image_iff)
-done
+by (induct ms)
+   (auto simp:distinct_fst_def compM_def image_iff)
 (*>*)
 
 
 lemma [iff]: "wf_syscls (compP f P) = wf_syscls P"
 (*<*)by(simp add:wf_syscls_def compP_def compC_def image_def Bex_def)(*>*)
 
 
 lemma [iff]: "wf_fdecl (compP f P) = wf_fdecl P"
 (*<*)by(simp add:wf_fdecl_def)(*>*)
 
 
 lemma wf_clinit_compM [iff]: "wf_clinit (map (compM f) ms) = wf_clinit ms"
 (*<*)
-apply(simp add: wf_clinit_def compM_def)
-apply(rule iffI)
- apply clarsimp apply(rename_tac m)
- apply(rule_tac x = m in exI, simp+)
-apply clarsimp apply(rename_tac m)
-apply(rule_tac x = "f Static m" in exI, simp add: rev_image_eqI)
-done
+proof(rule iffI)
+  assume "wf_clinit (map (compM f) ms)"
+  then obtain m where "(clinit, Static, [], Void, m) \<in> set ms"
+    by(clarsimp simp: wf_clinit_def compM_def)
+  then show "wf_clinit ms" by(fastforce simp: wf_clinit_def)
+next
+  assume "wf_clinit ms"
+  then obtain m where "(clinit, Static, [], Void, m) \<in> set ms"
+    by(clarsimp simp: wf_clinit_def compM_def)
+  then have "\<exists>m. (clinit, Static, [], Void, m)
+        \<in> (\<lambda>x. case x of (M, b, Ts, T, m) \<Rightarrow> (M, b, Ts, T, f b m)) ` set ms"
+    by(rule_tac x = "f Static m" in exI) (simp add: rev_image_eqI)
+  then show "wf_clinit (map (compM f) ms)"
+    by(simp add: wf_clinit_def compM_def)
+qed
 (*>*)
 
 lemma set_compP:
  "((C,D,fs,ms') \<in> set(compP f P)) =
   (\<exists>ms. (C,D,fs,ms) \<in> set P \<and> ms' = map (compM f) ms)"
 (*<*)by(fastforce simp add:compP_def compC_def image_iff Bex_def)(*>*)
 
 lemma wf_cdecl_compPI:
   "\<lbrakk> \<And>C M b Ts T m. 
      \<lbrakk> wf_mdecl wf\<^sub>1 P C (M,b,Ts,T,m); P \<turnstile> C sees M,b:Ts\<rightarrow>T = m in C \<rbrakk>
      \<Longrightarrow> wf_mdecl wf\<^sub>2 (compP f P) C (M,b,Ts,T, f b m);
     \<forall>x\<in>set P. wf_cdecl wf\<^sub>1 P x; x \<in> set (compP f P); wf_prog p P \<rbrakk>
   \<Longrightarrow> wf_cdecl wf\<^sub>2 (compP f P) x"
 (*<*)
-apply(clarsimp simp add:wf_cdecl_def Ball_def set_compP)
-apply(rename_tac C D fs ms)
-apply(rule conjI)
- apply (clarsimp simp:compM_def)
- apply (drule (2) mdecl_visible)
- apply simp
-apply(clarify)
-apply(drule sees_method_compPD[where f = f])
-apply clarsimp
-apply(fastforce simp:image_iff compM_def)
-done
+proof -
+  assume
+   wfm: "\<And>C M b Ts T m. \<lbrakk> wf_mdecl wf\<^sub>1 P C (M,b,Ts,T,m); P \<turnstile> C sees M,b:Ts\<rightarrow>T = m in C \<rbrakk>
+     \<Longrightarrow> wf_mdecl wf\<^sub>2 (compP f P) C (M,b,Ts,T, f b m)"
+    and wfc: "\<forall>x\<in>set P. wf_cdecl wf\<^sub>1 P x"
+    and compP: "x \<in> set (compP f P)" and wf: "wf_prog p P"
+  obtain C D fs ms where x: "x = (C, D, fs, map (compM f) ms)"
+    and x_set: "(C, D, fs, ms) \<in> set P"
+   using compP by(case_tac x) (clarsimp simp: set_compP)
+  have wfc': "wf_cdecl wf\<^sub>1 P (C, D, fs, ms)" using wfc x_set by fast
+  let ?P = "compP f P" and ?ms = "compM f ` set ms"
+  { fix M b Ts T m
+    assume M: "(M,b,Ts,T,m) \<in> set ms"
+    then have "wf_mdecl wf\<^sub>1 P C (M, b, Ts, T, m)" using wfc'
+      by(simp add:wf_cdecl_def)
+    moreover have cM: "P \<turnstile> C sees M, b :  Ts\<rightarrow>T = m in C" using M
+      by(rule mdecl_visible[OF wf x_set])
+    ultimately have "wf_mdecl wf\<^sub>2 (compP f P) C (M, b, Ts, T, f b m)"
+      by(rule wfm)
+  }
+  then have "\<forall>m \<in> ?ms. wf_mdecl wf\<^sub>2 ?P C m"
+    by (clarsimp simp:compM_def)
+  moreover have "C \<noteq> Object \<longrightarrow>
+   (\<forall>(M,b,Ts,T,m)\<in>?ms.
+      \<forall>D' b' Ts' T' m'. ?P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D' \<longrightarrow>
+                       b = b' \<and> P \<turnstile> Ts' [\<le>] Ts \<and> P \<turnstile> T \<le> T')"
+  proof -
+    { fix M b Ts T m D' b' Ts' T' m'
+      assume "C \<noteq> Object" and "(M,b,Ts,T,m)\<in>?ms"
+        and dM: "?P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D'"
+      then have "b = b' \<and> P \<turnstile> Ts' [\<le>] Ts \<and> P \<turnstile> T \<le> T'"
+       using wfc' sees_method_compPD[OF dM]
+        by(fastforce simp:wf_cdecl_def image_iff compM_def)
+    }
+    then show ?thesis by fast
+  qed
+  moreover have "(\<forall>f\<in>set fs. wf_fdecl P f) \<and> distinct_fst fs
+     \<and> distinct_fst ms \<and> wf_clinit ms
+     \<and> (C \<noteq> Object \<longrightarrow> is_class P D \<and> \<not> P \<turnstile> D \<preceq>\<^sup>* C)" using wfc'
+    by(simp add: wf_cdecl_def)
+  ultimately show ?thesis using x by(simp add:wf_cdecl_def)
+qed
 (*>*)
 
 
 lemma wf_prog_compPI:
 assumes lift: 
   "\<And>C M b Ts T m. 
     \<lbrakk> P \<turnstile> C sees M,b:Ts\<rightarrow>T = m in C; wf_mdecl wf\<^sub>1 P C (M,b,Ts,T,m) \<rbrakk>
     \<Longrightarrow> wf_mdecl wf\<^sub>2 (compP f P) C (M,b,Ts,T, f b m)"
 and wf: "wf_prog wf\<^sub>1 P"
 shows "wf_prog wf\<^sub>2 (compP f P)"
 (*<*)
 using wf
 by (simp add:wf_prog_def) (blast intro:wf_cdecl_compPI lift wf)
 (*>*)
 
 
 end