一句话：通过动态分析消除 Csmith 冗余安全包装器，生成更接近 UB 边缘但无 UB 的程序，发现 GCC 新误编译错误。
随机化编译器测试需要能生成无未定义行为（UB）的程序，以可靠暴露误编译错误。现有生成器如 Csmith 为达到 UB-free 而严重限制程序形式，可能降低测试覆盖。作者提出生成限制更少、但仍无 UB、即更接近 UB 边缘却未越界的程序。其原型工具 CsmithEdge 使用简单动态分析，判断 Csmith 在算术操作的安全数学包装器使用上何处过于保守，并消除冗余包装器。评估中，CsmithEdge 在 GCC 上发现两个常规 Csmith 密集测试无法发现的误编译错误，并在代码覆盖上取得显著差异。
Randomised compiler testing techniques require a means of generating programs that are free from undefined behaviour (UB) in order to reliably reveal miscompilation bugs. Existing program generators such asCsmithheavily restrict the form of generated programs inorder to achieve UB-freedom. We hypothesise that the idiomatic nature of such programs limits the test coverage they can offer. Our idea is to generate less restricted programs that are still UB-free—programs that get closer to the edge of UB, but that do not quite cross the edge. We present preliminary support for our idea via a prototype tool, CsmithEdge, which uses simple dynamic analysis to determine whereCsmithhas been too conservative in its use of safe math rappers that guarantee UB-freedom for arithmetic operations. By eliminating redundant wrappers,CsmithEdge was able to discover two new miscompilation bugs in GCC that could not be found via intensive testing using regular Csmith, and to achieve substantial differences in code coverage on GCC compared with regular Csmith.
DOI 原文 ·
@inproceedings{paperbot5900,
title = {Closer to the edge},
author = {Karine Even-Mendoza and Cristian Cadar and Alastair F. Donaldson},
booktitle = {ASE},
year = {2020},
doi = {10.1145/3324884.3418933}
}