一句话：对 ASan 与七种优化型 sanitizer 进行统一的部署导向实证比较，量化其性能、检出与部署权衡。
AddressSanitizer（ASan）已广泛用于工业级 C/C++ 开发，但其运行时与内存开销限制了在持续集成和生产级测试中的常规使用。尽管已有多种优化型 ASan 类工具，异构的工作负载、配置与基线使其实际权衡难以比较。本文提出一项统一、面向部署的实证研究，覆盖 ASan 与七种代表性优化 sanitizer（ASan--、SanRazor、GiantSan、RSan、MEDs、ASAP、LFP）。作者使用 17 个 SPEC CPU2006 基准、Juliet、MSET、21 个真实 CVE 以及一个多线程 MySQL 案例，考察组件开销、参数敏感性、构建配置、检出结果与可部署性。有序累积消融显示，首步运行时下降最大者来自移除内存访问检查，而后期 RSS 下降最大者出现在堆管理步骤；参数调优能在 Juliet 上找到更低内存配置且相对默认 ASan 不增加假阴性，但这并不能证明延迟 UAF 检出能力得以保持。结果表明各工具在效率、检出与部署上表现各异，但完成集不相等使正式跨工具排名不可行，并支持将调优后的 ASan 视为 sanitizer 评估中必需的、依赖配置的比较基线。
AddressSanitizer (ASan) is widely deployed in industrial C/C++ development, but its runtime and memory costs can limit routine use in continuous integration and production-like testing. Although many optimized ASan-like sanitizers have been proposed, heterogeneous workloads, configurations, and baselines make their practical trade-offs difficult to compare. We present a unified, deployment-oriented empirical study of ASan and seven representative optimized sanitizers: ASan--, SanRazor, GiantSan, RSan, MEDs, ASAP, and LFP. Using 17 SPEC CPU2006 benchmarks, Juliet, MSET, 21 real-world CVEs, and a multi-threaded MySQL case study, we examine component costs, parameter sensitivity, build configurations, detection outcomes, and deployability. In our ordered cumulative ablation, the largest first-step runtime reduction follows removal of memory-access checks, while the largest late-stage RSS reduction occurs at the heap-management step. Parameter tuning identifies lower-memory configurations without additional false negatives relative to default ASan on Juliet, although this result does not establish preservation of delayed-UAF detection. The reported evidence shows distinct efficiency, detection, and deployment outcomes, but unequal completion sets prevent a formal cross-tool ranking. Our results support treating tuned ASan as a necessary, configuration-dependent comparison baseline for sanitizer evaluation and provide bounded evidence for deployment decisions under different resource and risk constraints.
@inproceedings{paperbot12193,
title = {Understanding the Performance-Effectiveness Trade-Offs of AddressSanitizer in Real-World Programs: An Empirical Study},
author = {Jiaxin Xi and Cheng Wen and Zhiwei Lin and Yuandao Cai and Jie Su and Bin Yu and Zhuohua Li and Shengchao Qin},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834469}
}