pub proof fn lemma_u8_log2_bounds(x: u8)
0 <= log(2, x as int) <= u8::BITS,
0 <= x.ilog2() <= u8::BITS,