一句话：提出差分测试框架 UBFuzz，用阴影语句插入生成 UB 程序并以崩溃点映射为判定器，检测 sanitizer 实现缺陷。
本文关注编译器 sanitizer 实现本身的正确性问题，尤其是漏报（false negative）缺陷。作者提出一套 sanitizer 实现测试框架，核心包含两部分：一是面向未定义行为（UB）的程序生成器，采用“阴影语句插入”方法将 UB 通用地引入合法种子程序；二是新的测试判定器“崩溃点映射”（crash-site mapping），用于区分 sanitizer 报告差异究竟源于编译器优化还是 sanitizer 缺陷。生成的 UB 程序被用于多个 sanitizer 实现的差分测试，并通过崩溃点映射精确定位真正由 sanitizer bug 引起的差异。作者将技术实现为工具 UBFuzz，在五个月的测试中于 GCC 与 LLVM sanitizer 中发现 31 个缺陷，揭示了严重的漏报问题，为该方向后续研究奠定基础。
In this paper, we propose a testing framework for validating sanitizer implementations in compilers. Our core components are (1) a program generator specifically designed for producing programs containing undefined behavior (UB), and (2) a novel test oracle for sanitizer testing. The program generator employs Shadow Statement Insertion, a general and effective approach for introducing UB into a valid seed program. The generated UB programs are subsequently utilized for differential testing of multiple sanitizer implementations. Nevertheless, discrepant sanitizer reports may stem from either compiler optimization or sanitizer bugs. To accurately determine if a discrepancy is caused by sanitizer bugs, we introduce a new test oracle called crash-site mapping. We have incorporated our techniques into UBfuzz, a practical tool for testing sanitizers. Over a five-month testing period, UBfuzz successfully found 31 bugs in both GCC and LLVM sanitizers. These bugs reveal the serious false negative problems in sanitizers, where certain UBs in programs went unreported. This research paves the way for further investigation in this crucial area of study.