The Correctness of Set-Sharing