一句话：提出黑盒工具 CLower，通过随机 C 程序插桩执行检测编译器冗余内存访问（悲观化）缺陷，在 GCC/LLVM 发现 23 个缺陷。
编译器有时引入冗余指令（悲观化），不仅带来性能开销，还通过意外副作用（如冗余内存访问）扩大攻击面；现有方法难以检测此类安全敏感的悲观化。CLower 提出黑盒检测：核心洞察是全优化二进制中相比源码多出的全局内存访问即指示悲观化。为区分编译器引入与源码级冗余，它生成随机 C 程序，其中每个全局变量的访问次数预先设定且可控，执行插桩二进制并验证是否引入多余访问。在 GCC 和 LLVM 上，CLower 报告 23 个唯一缺陷（GCC 21、Clang 2），16 个为新的悲观化缺陷；75% 的缺陷也出现在堆对象上。研究还揭示优化与悲观化缺陷之间的系统性冲突。
Compilers are expected to generate optimized code, but they sometimes introduce pessimizations, quality-degrading redundant instructions. These bugs not only incur performance overhead but also, critically, expand the attack surface by introducing unexpected side effects (e.g., redundant memory accesses) without breaking compilation correctness. Existing bug-finding methods are neither designed for nor effective at identifying such security-sensitive pessimizations. This paper presents CLower, a novel, black-box approach for automatically detecting compiler pessimizations via redundant memory accesses. CLower’s core insight is that any extra global memory accesses in a fully optimized binary, compared to the source, indicate a pessimization. To reliably distinguish compiler-introduced redundancy from source-level redundancy, we generate random C programs in which each global variable has a predetermined, controlled number of memory accesses. CLower then executes the instrumented binary and verifies whether superfluous accesses have been introduced during compilation. We applied CLower to GCC and LLVM, reporting 23 unique bugs (21 in GCC, 2 in Clang), with 16 confirmed as new pessimization bugs. Our evaluation shows that CLower accurately detects diverse, impactful pes-simization bugs, the majority of which (75%) also manifest for heap-allocated objects, demonstrating that the underlying compiler flaws are general and not limited to global memory. Furthermore, we identify a systematic conflict between compiler optimizations and pessimization bugs, which causes many such bugs to remain hidden in compiler versions. This study sheds light on the under-explored area of compiler pessimization and provides a practical tool for improving compiler quality.
@article{paperbot3826,
title = {CLower: Detecting Compiler Pessimization Bugs through Redundant Memory Accesses},
author = {Jianhao Xu and Kunbo Zhang and Mathias Payer and Kangjie Lu and Bing Mao},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {OOPSLA1},
year = {2026},
doi = {10.1145/3798250}
}