一句话：首个针对 MLIR 编译器基础设施的模糊测试技术，用两阶段策略生成有效多样的 MLIR 程序并发现 53 个新缺陷。
MLIR 编译器基础设施近年来被广泛用于构建各类编译器：它不再为每个领域单独设计单一抽象的 IR，而是提供系统化的 pass 支持多领域功能，并用 dialect 支撑不同层次的抽象。由于其基础性地位，保证其质量十分关键。本文提出 MLIRSmith，这是首个面向 MLIR 编译器基础设施的模糊测试技术。它采用两阶段策略生成有效且多样的 MLIR 程序：首先依据扩展的 MLIR 语法规则构造多样化的程序模板，然后通过所设计的上下文敏感文法引导模板实例化，生成合法的 MLIR 程序。作者将 MLIRSmith 应用于最新版本的 MLIR 编译器基础设施，共发现 53 个此前未知的缺陷，其中 49 个已被开发者确认、38 个得到修复；同时还将 NNSmith（面向深度学习编译器的高层程序生成器）生成的程序转换为 MLIR 程序以间接测试 MLIR，在相同测试时间内，MLIRSmith 发现的缺陷数比该间接方法多 328.57%，行覆盖率与分支覆盖率分别高出 194.67% 和 225.87%。
MLIR (Multi-Level Intermediate Representation) compiler infrastructure has gained popularity in recent years to support the construction of many compilers. Instead of designing a new IR with a single abstraction for each domain, MLIR compiler infrastructure provides systematic passes to support a wide range of functionalities for benefiting multiple domains together and introduces dialects to support different levels of abstraction in MLIR. Due to its fundamental role in compiler community, ensuring its quality is very critical. In this work, we propose MLIRSmith, the first fuzzing technique for MLIR compiler infrastructure. MLIRSmith employs a two-phase strategy to generate valid and diverse MLIR programs, which first constructs diverse program templates guided by extended MLIR syntax rules and then generates valid MLIR programs through template instantiation guided by our designed context-sensitive grammar. After applying MLIRSmith to the latest revision of MLIR compiler infrastructure, we detected 53 previously unknown bugs, among which 49/38 have been confirmed/fixed by developers. We also transform the high-level programs generated by NNSmith (a high-level program generator for deep learning compilers) to MLIR programs for indirectly fuzzing MLIR compiler infrastructure. During the same testing time, MLIRSmith largely outperforms such an indirect technique by detecting 328.57% more bugs and covering 194.67%/225.87% more lines/branches in MLIR compiler infrastructure.
@inproceedings{WangCXLWSZ23,
title = {MLIRSmith: Random Program Generation for Fuzzing MLIR Compiler Infrastructure},
author = {Haoyu Wang and Junjie Chen and Chuyue Xie and Shuang Liu and Zan Wang and Qingchao Shen and Yingquan Zhao},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00120}
}