\documentclass[sans]{beamer}

\usepackage{lmodern}
\usepackage{tikz}
\usepackage{pdfpages}
\usepackage{listings}
\usetikzlibrary{arrows, positioning, shapes.geometric}
\usetikzlibrary{shadows.blur}

% hide the footline navigation
\setbeamertemplate{footline}[frame number]{}
\setbeamertemplate{navigation symbols}{}
\setbeamertemplate{footline}{}

\tikzset{
    %Define standard arrow tip
    >=stealth',
}

\tikzset{
    invisible/.style={opacity=0,text opacity=0},
    visible on/.style={alt=#1{}{invisible}},
    alt/.code args={<#1>#2#3}{%
      \alt<#1>{\pgfkeysalso{#2}}{\pgfkeysalso{#3}}
    },
}

\tikzset{
  setstyle/.style={#1},
  %bcg/.default={white},
  setstyle on/.style={alt=#1{}{setstyle}},
}

\tikzset{
  background fill/.style={fill=#1},
  background fill/.default={white},
  fill on/.style={alt=#1{}{background fill}},
}

\tikzset{
  background draw/.style={draw=#1},
  background draw/.default={white},
  draw on/.style={alt=#1{}{background draw}},
}

\tikzset{
  background filldraw/.style 2 args={draw=#1, fill=#2},
  background filldraw/.default={white}{white},
  filldraw on/.style={alt=#1{}{background filldraw}},
}

\tikzset{
  background shade/.style={#1},
  background shade/.default={top color=white, bottom color=white},
  shade on/.style={alt=#1{}{background shade}},
}

\tikzset{
  background shadedraw/.style 2 args={draw=#1, #2},
  background shadedraw/.default={white}{top color=white, bottom color=white},
  shadedraw on/.style={alt=#1{}{background shadedraw}},
}

\begin{document}
  \centering
%% -------------------------------------------------------------------
  \begin{frame}
  \huge{\textbf{SYMBIOTIC \textcolor{red}{4}}}\\
  \vspace{0.3cm}
  \large{BEYOND REACHABILITY}
   \vspace{1cm}

    \underline{Marek~Chalupa}, Martin~Jon\'{a}\v{s}, Jiri~Slaby,\\
    Jan~Strej\v{c}ek, and Martina Vitovsk\'{a}

     \vspace{1cm}
   Masaryk University, Brno
  \end{frame}
%% -------------------------------------------------------------------

  %% - just for DACSE
%% -------------------------------------------------------------------
 %\begin{frame}
 %%\frametitle{Symbiotic}
 %\begin{flushleft}
 %Symbiotic is a tool that
 %\end{flushleft}
 %\begin{itemize}
 %\setlength\itemsep{1em}
 %  \item automatically finds errors in computer programs
 %  \item is open-source
 %  \item is developed at Faculty of Informatics, Masaryk University
 %\end{itemize}
 %\end{frame}
%% -------------------------------------------------------------------

%% -------------------------------------------------------------------
  \begin{frame}
  %\frametitle{Symbiotic}
  \vspace*{3cm}
  \begin{tikzpicture}[scale=0.75]
    	\tikzset{
	  wn/.style={draw, fill=white,
	             %line width=1pt,
		     minimum height=2em,
	             %shade,
	             shape=rectangle,
		     line width=0.5pt,
		     rounded corners},
	 shd/.style={blur shadow={shadow blur steps=5}}
	},

 \node[overlay, wn, shd] (instr) at (-2, 7) { INSTRUMENTATION};
 \node[overlay, wn, shd, align=center] (slicing) at (4, 8)  { PROGRAM\\SLICING};
 \node[overlay, wn, shd, align=center] (se) at (8, 6) { SYMBOLIC\\EXECUTION};

  %% -- RECTANGLE
  %front
  \fill[orange, draw=black, thick] (0,0) -- (4,0) -- (4,4) -- (0,4) -- cycle;
  % right side
  \fill[orange!100!red!70, draw=black, thick] (4,0) -- (4,4) -- (5,5) -- (5, 1)-- cycle;
  % top
  \fill[black!65, draw=black, thick] (0,4) -- (4,4) -- (5,5) -- (1, 5)-- cycle;
  \fill[black!55, draw=black, thick] (1,5) -- (1,4) -- (0,4) -- cycle;
  %\node[overlay, rotate=45] (sign) at (2, 2) { SYMBIOTIC};
  \end{tikzpicture}
  \end{frame}
%% -------------------------------------------------------------------

%% -------------------------------------------------------------------
  \begin{frame}
  %\frametitle{Symbiotic}
  \vspace*{3cm}
  \begin{tikzpicture}[scale=0.75]
    	\tikzset{
	  wn/.style={draw, fill=white,
	             %line width=1pt,
		     minimum height=2em,
	             %shade,
	             shape=rectangle,
		     line width=0.5pt,
		     rounded corners},
	 shd/.style={blur shadow={shadow blur steps=5}}
	},

 \node<1>[overlay, wn, shd, align=center] (slicing) at (4, 8)  { PROGRAM\\SLICING};
 \node<1-2>[overlay, wn, shd, align=center] (se) at (8, 6) { SYMBOLIC\\EXECUTION};

  %% -- RECTANGLE
  \fill[black!65, draw=black, thick] (0,4) -- (4,4) -- (5,5) -- (1, 5)-- cycle;
  \fill[black!55, draw=black, thick] (1,5) -- (1,4) -- (0,4) -- cycle;

  \node<3>[overlay, wn, shd, align=center, rotate=-90] (se) at (2.3, 4.5) { SYMBOLIC\\EXECUTION};
  \node[overlay, wn, shd, rotate=-60] (instr) at (1, 4) { INSTRUMENTATION};
  \node<2->[overlay, wn, shd, align=center, rotate=50] (slicing) at (3.4, 4.1)  { PROGRAM\\SLICING};
  \fill[orange, draw=black, thick] (0,0) -- (4,0) -- (4,4) -- (0,4) -- cycle;
  \fill[orange!100!red!70, draw=black, thick] (4,0) -- (4,4) -- (5,5) -- (5, 1)-- cycle;

  \tikzset{overlaybox/.style={draw=black, minimum width=2em,
	                            fill=yellow!30, align=left,
                              dashed, overlay, text depth=5,
                              opacity=1, rounded corners}}
  \node<1>[overlaybox] (float-instr) at (-1, 0.5)%(2,2)
              {\textbf{Instrumentation}\\[1em]
                Make memory symbolic.\\[0.5em]
                Define \_\_VERIFIER\_* functions.\\[0.5em]
                Insert runtime error checks.
               };

  \node<2>[overlaybox] (float-slicing) at (-1, 0.5)
              {\textbf{Program Slicing}\\[1em]
                Keep only the statements that can have\\
               %an effect on the error reachability
               some effect on the inserted checks.
               };

  \node<3>[overlaybox] (float-se) at (-1, 0.5)
              {\textbf{Symbolic execution}\\[1em]
               Explore all execution paths\\
               in the sliced program to decide\\
               whether an error is reachable.
               };

  \end{tikzpicture}
  \end{frame}
%% -------------------------------------------------------------------

%% -------------------------------------------------------------------
  \begin{frame}
  %\frametitle{Symbiotic}
  %\vspace*{-3cm}
  \begin{tikzpicture}[scale=1.7]
    	\tikzset{
	  wn/.style={draw, fill=white,
	             %line width=1pt,
		     minimum height=2em,
	             %shade,
	             shape=rectangle,
		     line width=0.5pt,
		     rounded corners},
	 shd/.style={blur shadow={shadow blur steps=5}},
   rec/.style={thick, opacity=0.7}
	},

  \node[overlay, wn, shd] (src) at (-0.5, 4.5) { SOURCE };
  \node[overlay] (llvm-dummy) at (1, 3.5) {};
  \draw[->] (src) |- (llvm-dummy);

  %% -- RECTANGLE
  % back
  \fill[orange!100!red!60, draw=black, rec] (1,1) -- (5,1) -- (5,5) -- (1, 5)-- cycle;
  % left side
  \fill[orange!100!red!70, draw=black, rec] (0,0) -- (1,1) -- (1,5) -- (0, 4)-- cycle;
  % bottom
  \fill[orange!100!red!60, draw=black, rec] (0,0) -- (4,0) -- (5,1) -- (1, 1)-- cycle;
  \draw[draw=black, rec] (5, 1) -- (1, 1) -- (1, 5);
  \draw[draw=black, rec] (1, 1) -- (0, 0);

  \node[overlay, wn, shd, align=center] (llvm) at (1, 3.5) { LLVM };
  \node[overlay, wn, shd] (instr) at (3, 3.5) { INSTRUMENTATION};
 %\node<2>[fill=yellow, overlay,
 %         wn, shd, align=center,
 %         scale=1.2, fill=yellow] (instr2) at (0, 2) { BETTER\\INSTRUMENTATION };
  \node[overlay, wn, shd, align=center] (slicing) at (3, 2.5)  { PROGRAM\\SLICING};
  \node[wn, shd, align=center] (se) at (3, 1.3) { SYMBOLIC\\EXECUTION \\ (klee)};

  \node[] (llvm-dummy1) at (0.35, 3.5)  {
   %\begin{tikzpicture}
   %\fill (0, 0) circle (0.1cm);
   %\end{tikzpicture}
  };

  \draw[->, thick] (llvm-dummy1) edge (llvm);
  \draw<1>[->, thick] (llvm) edge (instr);
  \draw<1>[->, thick] (instr) edge (slicing);
  \draw[->, thick] (slicing) edge (se);

  %\draw<2>[->, thick] (llvm) edge (instr2);
  %\draw<2>[->, thick] (instr2) edge (slicing);
 %\draw<2>[->, line width=0.7mm, dashed] (instr2) edge (instr);
 %\node<2>[overlay] at (3, 3.5) {
 %  \begin{tikzpicture}
 %  \draw[draw=red, line width=1mm] (0, 0) -- (1, 1);
 %  \draw[draw=red, line width=1mm] (0, 1) -- (1, 0);
 %  \end{tikzpicture}
 %};

  % right side
  \fill[orange!100!red!70, draw=black, rec] (4,0) -- (4,4) -- (5,5) -- (5, 1)-- cycle;
  % top
  \fill[orange!100!red!60, draw=black, rec] (0,4) -- (4,4) -- (5,5) -- (1, 5)-- cycle;

  \node<2>[fill=yellow, overlay,
           wn, shd, align=center,
           scale=1.2,
           fill=yellow] (instr3) at (3, 3.5) { BRAND NEW\\INSTRUMENTATION };

  \draw<2>[->, thick] (llvm) edge (instr3);
  \draw<2>[->, thick] (instr3) edge (slicing);

  \end{tikzpicture}

  \end{frame}
%% -------------------------------------------------------------------

%% -------------------------------------------------------------------
 \begin{frame}[fragile]
 \frametitle{New Instrumentation}
 \begin{itemize}
 \setlength\itemsep{1em}
  \item flexible -- instrumentation rules in JSON
  \item a rule consists of
  \begin{itemize}
    \item a pattern
    \item a code to insert
    \item a condition -- checked by a query to a static analysis
  \end{itemize}
  \bigskip
 %\item the condition is checked by a query to a static analysis
 \end{itemize}

\begin{tikzpicture}
\tikzset{
  wn/.style={draw, fill=white,
             %line width=1pt,
	     minimum height=2em,
             %shade,
             shape=rectangle,
	     line width=0.5pt,
	     rounded corners},
 shd/.style={blur shadow={shadow blur steps=5}}
},

\node[shd, fill=yellow!30, rounded corners, draw] at (2.5, 5.3) {
\begin{lstlisting}[basicstyle=\footnotesize]
"find": [
           {
             "instruction": "store",
             "operands": ["<x>", "<p>"]
           }
        ],
"insert": ["__INSTR_check_pointer", "<p>"],
"where": "before",
"condition": ["!isValidPointer", "<p>"],
\end{lstlisting}
};
\end{tikzpicture}

 \end{frame}
%% -------------------------------------------------------------------

%% -------------------------------------------------------------------
\begin{frame}[fragile]
  \frametitle{New Instrumentation -- Example}
  %\framesubtitle{Example}
\lstset{% Add other global options here
 % basicstyle=\small\sffamily,
  escapechar=@% char to escape out of listings and back to LaTeX
}

  \begin{lstlisting}[language=C]
int array[10];

      @$\vdots$@

array[3] = 1;

      @$\vdots$@

n = input();

array[n] = n;
  \end{lstlisting}

\begin{tikzpicture}
\tikzset{
  wn/.style={draw, fill=white,
             %line width=1pt,
	     minimum height=2em,
             %shade,
             shape=rectangle,
	     line width=0.5pt,
	     rounded corners},
 shd/.style={blur shadow={shadow blur steps=5}}
},

\node[shd, overlay, fill=yellow!30, rounded corners, draw] at (2.5, 5.6) {
\begin{lstlisting}[basicstyle=\tiny]
"find": [
           {
             "instruction": "store",
             "operands": ["<x>", "<p>"]
           }
        ],
"insert": ["__INSTR_check_pointer", "<p>"],
"where": "before",
"condition": ["!isValidPointer", "<p>"],
\end{lstlisting}
};
\end{tikzpicture}
\end{frame}
%% -------------------------------------------------------------------

%% -------------------------------------------------------------------

\begin{frame}[fragile]
  \frametitle{New Instrumentation -- Example}
  %\framesubtitle{Example}
\lstset{% Add other global options here
 % basicstyle=\small\sffamily,
  escapechar=@% char to escape out of listings and back to LaTeX
}

\begin{lstlisting}[language=C]
int array[10];

      @$\vdots$@

array[3] = 1;

      @$\vdots$@

n = input();
@\color{red}\_\_INSTR\_check\_pointer(\&array[n]);@
array[n] = n;
  \end{lstlisting}

\begin{tikzpicture}
\tikzset{
  wn/.style={draw, fill=white,
             %line width=1pt,
	     minimum height=2em,
             %shade,
             shape=rectangle,
	     line width=0.5pt,
	     rounded corners},
 shd/.style={blur shadow={shadow blur steps=5}}
},

\node[shd, overlay, fill=yellow!30, rounded corners, draw] at (2.5, 5.6) {
\begin{lstlisting}[basicstyle=\tiny]
"find": [
           {
             "instruction": "store",
             "operands": ["<x>", "<p>"]
           }
        ],
"insert": ["__INSTR_check_pointer", "<p>"],
"where": "before",
"condition": ["!isValidPointer", "<p>"],
\end{lstlisting}
};

\node[overlay] (aux1) at (-2.2,3.7) { };
\node[overlay] (aux2) at (-2,0.8) { };
\node[overlay, opacity=0.2, fill=red, minimum width=2.3cm] (aux3) at (2.65,4.63) {};
\node[overlay, wn, shd, align=center] (pta) at (2.65, 2.7) { pointer\\analysis};
\draw[overlay, ->, dashed] (pta) edge node[sloped, yshift=3mm] { no check needed } (aux1);
%\draw[overlay, ->, dashed] (pta) edge node[sloped, yshift=-3mm] { check inserted here } (aux2);
\draw[overlay, ->, dashed] (aux3) edge node[xshift=7mm, yshift=-2mm] { query } (pta);
\end{tikzpicture}
\end{frame}
%% -------------------------------------------------------------------



%% -------------------------------------------------------------------
 \begin{frame}
 \frametitle{New Instrumentation}
 \flushleft \texttt{\_\_INSTR\_check\_*} functions are
 \vspace{5mm}
 \begin{itemize}
 \setlength\itemsep{1em}
  \item implemented in C
  \item compiled to LLVM and linked to the program
 \end{itemize}
 \end{frame}
%% -------------------------------------------------------------------

%% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{SV-COMP 2017 Results - MemSafety}
  \begin{tikzpicture}[overlay, opacity=0.25]
  \fill[yellow] (-5, -2.35) -- (5,-2.35) -- (5, -1.88) -- (-5, -1.88) -- cycle;
  \end{tikzpicture}

  \begin{center}
  \begin{table}[h]
  %\caption{Results of the first three tools in \emph{MemSafety} category of SV-COMP 2017.}
  \label{tab:svcomp-memsafety}
  \begin{tabular}{l l r r r}
   & tool & score & CPU time [h] & solved tasks \\
   \hline
   1 & \textsc{PredatorHP} & 319 & 0.82  & 219 \\
   2 & \textsc{UAutomizer} & 308 & 1.9   & 145 \\
   3 & \textsc{Symbiotic}  & 304 & {\bf 0.08}  & {\bf 233}
  \end{tabular}
  \end{table}
  \end{center}
  \end{frame}
%% -------------------------------------------------------------------

%% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Conclusion}
  \begin{itemize}
  \setlength\itemsep{1em}
   \item Combining instrumentation (runtime checks) with static analysis
         is easy but powerful technique
  \item Program slicing can further improve the performance
  \item This approach is competitive with state-of-the-art tools
        for checking memory safety
  \end{itemize}
  \vspace{1cm}
  \pause
  \textcolor{blue}{\url{https://github.com/staticafi/symbiotic}}\\[1em]
  \end{frame}
%% -------------------------------------------------------------------

% etc
\end{document}
