一句话：利用操作依赖图与依赖覆盖引导变异，提升 MLIR 编译器模糊测试效果并发现 63 个新缺陷。
MLIR 编译器基础设施近年来被广泛使用，它通过 dialect 支持不同抽象层次的表示，其正确性至关重要。已有的基于文法的模糊测试技术 MLIRSmith 虽然有效，但以随机方式生成测试程序，限制了输入空间的探索，从而制约了整体模糊测试效果。本文提出新的模糊测试技术：由于复杂或不常见的操作间数据/控制依赖常有助于触发 MLIR 缺陷，该工作为 MLIR 程序构建操作依赖图，并定义相应的操作依赖覆盖率来引导模糊测试过程；为驱使测试向更高依赖覆盖推进，进一步设计了一组面向依赖的变异规则。作者将其实现在 MLIR 编译器基础设施的最新版本上运行，共检测到 63 个此前未知的缺陷，其中 38 个已被开发者修复、48 个已被确认。
MLIR (Multi-Level Intermediate Representation) compiler infrastructure has gained widespread popularity in recent years. It introduces dialects to accommodate various levels of abstraction within the representation. Due to its fundamental role in compiler construction, it is critical to ensure its correctness. Recently, a grammar-based fuzzing technique (i.e., MLIRSmith) has been proposed for it and achieves notable effectiveness. However, MLIRSmith generates test programs in a random manner, which restricts the exploration of the input space, thereby limiting the overall fuzzing effectiveness. In this work, we propose a novel fuzzing technique, called MLIR. As complicated or uncommon data/control dependencies among various operations are often helpful to trigger MLIR bugs, it constructs the operation dependency graph for an MLIR program and defines the associated operation dependency coverage to guide the fuzzing process. To drive the fuzzing process towards increasing operation dependency coverage, MLIR then designs a set of dependency-targeted mutation rules. By applying MLIR to the latest revisions of the MLIR compiler infrastructure, it detected 63 previously unknown bugs, among which 38/48 bugs have been fixed/confirmed by developers.
DOI 原文 ·
@inproceedings{paperbot8612,
title = {Fuzzing MLIR Compiler Infrastructure via Operation Dependency Analysis},
author = {Chenyao Suo and Junjie Chen and Shuang Liu and Jiajun Jiang and Yingquan Zhao and Jianrong Wang},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680360}
}