The loop invariant is

p + x*y == x0 * y0

When the loop terminates, x must be 0. Therefore we have our output assertion directly by substituting 0 for x.

When the loop is entered, p == 0 x == x0 y == y0, therefore the invariant holds initially, which gives us the basis.

Only the induction step is left. Assume that the invariant is true before the test, to show that, if there is a next time, the invariant holds for the new values, which are indicated by primes:

p' + x' * y' == x0 * y0

We know the following:

p' == p + (x%2)*y

x' == x /2 if x is even

x' == (x - 1)/2 if x is odd

y' == y*2

If x is even, the equality to be shown is, after making substitutions,

p + 0*y + (x/2) * (y*2) == x0 * y0

since x%2 is then 0, which simplifies to exactly the inductive assumption.

If x is odd, the equality to be shown is, after making substitutions,

p + 1*y + ((x-1) /2) * (y*2) == x0 * y0

since x%2 is then 1, which also simplifies to exactly the inductive assumption.