You need to write a specification that somehow handles correctly
void f() { X a; g(a);
For the transition to be safe, you will need to prove that the following code, including all the functions that it calls, does not have direct access to a , which is impossible in the general case, because the definitions of these functions may not be available to the compiler (for example, in another unit translation).
source share