paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Finding Compiler Bugs through Cross-Language Code Generator and Differential Testing

通过跨语言代码生成器与差分测试发现编译器缺陷
OOPSLA 9(OOPSLA2)2025匹配度 2/10 · 论文属于编译器正确性测试与差分测试,核心是跨语言代码生成和缺陷发现,既不涉及静态分析、LLM/Agent 改进或结合,也不涉及浮点程序分析或贝叶斯程序分析。虽然属于 PL/编译器领域,但与该研究画像的核心问题交集很弱。引用 2 inbox
Qiong Feng, Xiaotian Ma, Ziyuan Feng, Marat Akhin, Wei Song, Peng Liang
crossref: 2026-09-10

AI 速览

一句话:提出 CrossLangFuzzer,用统一 IR 生成跨语言 JVM 测试程序并结合变异与差分测试,发现 24 个编译器缺陷。

单语言编译器的正确性已有大量验证研究,但跨语言编译——涉及两种语言及其各自编译器的交互——的正确性仍基本空白。本文提出 CrossLangFuzzer,为基于 JVM 的语言引入通用中间表示(IR),自动生成带有多样类型参数和复杂继承结构的跨语言测试程序,并施加 LangShuffler、FunctionRemoval、TypeChanger 三种变异以增强程序多样性;随后在多个编译器版本上对原始与变异程序进行差分测试。该方法在 Kotlin 编译器确认 10 个缺陷、Groovy 编译器 4 个、Scala 3 编译器 7 个、Scala 2 编译器 2 个、Java 编译器 1 个,共 24 个真实缺陷;其中 TypeChanger 最有效,检出 11 个。作者还分析了跨编译缺陷的症状与根因,并讨论了跨语言编译出错时各语言编译器的责任划分。这是首个专门面向跨语言编译场景的编译器缺陷发现与诊断工作。

问题
跨语言编译的正确性依赖两种语言及其编译器之间的交互,但现有编译器验证研究几乎只关注单语言编译,跨语言场景的缺陷发现与诊断缺乏系统方法。
方法
提出 CrossLangFuzzer:为 JVM 语言设计通用中间表示以自动生成跨语言测试程序,并通过 LangShuffler、FunctionRemoval、TypeChanger 三种变异技术增加程序多样性。
评估
在多个编译器版本上对原始与变异程序进行差分测试,在 Kotlin、Groovy、Scala 3、Scala 2 和 Java 编译器中确认 24 个缺陷,并分析其症状与根因,其中 TypeChanger 检出 11 个缺陷,效果最佳。
原文摘要(Abstract)

Compilers play a central role in translating high-level code into executable programs, making their correctness essential for ensuring code safety and reliability. While extensive research has focused on verifying the correctness of compilers for single-language compilation, the correctness of cross-language compilation — which involves the interaction between two languages and their respective compilers — remains largely unexplored. To fill this research gap, we propose CrossLangFuzzer , a novel framework that introduces a universal intermediate representation (IR) for JVM-based languages and automatically generates cross-language test programs with diverse type parameters and complex inheritance structures. After generating the initial IR, CrossLangFuzzer applies three mutation techniques — LangShuffler, FunctionRemoval , and TypeChanger — to enhance program diversity. By evaluating both the original and mutated programs across multiple compiler versions, CrossLangFuzzer successfully uncovered 10 confirmed bugs in the Kotlin compiler, 4 confirmed bugs in the Groovy compiler, 7 confirmed bugs in the Scala 3 compiler, 2 confirmed bugs in the Scala 2 compiler, and 1 confirmed bug in the Java compiler. Among all mutators, TypeChanger is the most effective, detecting 11 of the 24 compiler bugs. Furthermore, we analyze the symptoms and root causes of cross-compilation bugs, examining the respective responsibilities of language compilers when incorrect behavior occurs during cross-language compilation. To the best of our knowledge, this is the first work specifically focused on identifying and diagnosing compiler bugs in cross-language compilation scenarios. Our research helps to understand these challenges and contributes to improving compiler correctness in multi-language environments.

链接与引用

DOI 原文 · PDF(开放获取) ·

BibTeX
@article{paperbot2930,
  title = {Finding Compiler Bugs through Cross-Language Code Generator and Differential Testing},
  author = {Qiong Feng and Xiaotian Ma and Ziyuan Feng and Marat Akhin and Wei Song and Peng Liang},
  journal = {Proceedings of the ACM on Programming Languages},
  volume = {9},
  number = {OOPSLA2},
  year = {2025},
  doi = {10.1145/3763152}
}