pub proof fn lemma_u32_log2_bounds(x: u32)
0 <= log(2, x as int) <= u32::BITS,
0 <= x.ilog2() <= u32::BITS,