pub proof fn lemma_u64_log2_bounds(x: u64)
0 <= log(2, x as int) <= u64::BITS,
0 <= x.ilog2() <= u64::BITS,