Compiler fuzzing using equivalence-modulo-inputs and optimization-log-guided-fuzzing

Sammanfattning

Compilers are a necessary part in the development of any modern software. As a result, the correctness of compilers not only concerns the compilers themselves but also any software that has been compiled by them. In particular, in the domain of critical applications such as telecommunications, compiler bugs have the potential to cause significant harm. Compiler fuzzing is an approach to validating compilers that has seen significant success in detecting compiler bugs such as crashes and miscompilations that static test suites miss. Three approaches to compiler fuzzing are Equivalence-modulo-inputs, concrete value-tracking, and Optimization-log-guided (OLG) fuzzing. This thesis presents novel work in combining these three approaches by using concrete-value tracking to construct EMI-variants and guiding variant acceptance using metadata from optimization logs. By extending CFuzzer, an internal fuzzer at Ericsson with the aforementioned methods, we uncovered eight new bugs in Ericsson’s internal LLVM compiler flacc, where three of these were upstream LLVM bugs, in the course of a three-month period. Additionally, we show that this approach achieves higher coverage than previous iterations of CFuzzer and, in some cases, a shorter time between bug occurrences. We also show a correlation between LLVM remarks and compiler coverage, indicating that counting remarks is a good lightweight approximation of LLVM coverage.