一句话：首个面向 Rust 编译器正确性的 fuzzer，通过生成 MIR 程序做差分测试，发现 22 个新缺陷。
编译器中间端和后端充满微妙易错的代码，其缺陷后果严重，因此需要提升对编译器正确性的信心并找出不可避免的 bug。随机差分测试是一种有效的模糊测试技术：让同一程序在不同编译器或编译设置下执行，检测行为差异。作者提出 Rustlantis，首个能在官方 Rust 编译器中找到新正确性缺陷的 fuzzer。为绕开 Rust 严格的类型与借用检查，它直接生成优化所用的核心 IR——MIR；生成策略结合静态跟踪程序状态、对编译器隐藏程序状态以及用诱饵基本块误导优化。该工具发现了 22 个此前未知的 Rust 编译器缺陷，大部分已修复。
Compilers are at the core of all computer architecture. Their middle-end and back-end are full of subtle code that is easy to get wrong. At the same time, the consequences of compiler bugs can be severe. Therefore, it is important that we develop techniques to increase our confidence in compiler correctness, and to help find the bugs that inevitably happen. One promising such technique that has successfully found many compiler bugs in the past is randomized differential testing , a fuzzing approach whereby the same program is executed with different compilers or different compiler settings to detect any unexpected differences in behavior. We present Rustlantis , the first fuzzer for the Rust programming language that is able to find new correctness bugs in the official Rust compiler. To avoid having to deal with Rust’s strict type and borrow checker, Rustlantis directly generates MIR, the central IR of the Rust compiler for optimizations. The program generation strategy of Rustlantis is a combination of statically tracking the state of the program, obscuring the program state for the compiler, and decoy blocks to lead optimizations astray. This has allowed us to identify 22 previously unknown bugs in the Rust compiler, most of which have been fixed.
@article{Wang024,
title = {Rustlantis: Randomized Differential Testing of the Rust Compiler},
author = {Qian Wang and Ralf Jung},
journal = {Proceedings of the ACM on Programming Languages},
volume = {8},
number = {OOPSLA2},
year = {2024},
doi = {10.1145/3689780}
}