There is a newer version of this record available.

Software Open Access

Compiler Fuzzing: How Much Does It Matter?

Michaël Marcozzi; Qiyi Tang; Cristian Cadar; Alastair Donaldson

Despite much recent interest in compiler randomized testing (fuzzing), the practical impact of fuzzer-found compiler bugs on real-world applications has barely been assessed. We present the first quantitative and qualitative study of the tangible impact of miscompilation bugs in a mature compiler. We follow a rigorous methodology where the bug impact over the compiled application is evaluated based on (1) whether the bug appears to trigger during compilation; (2) the extent to which generated assembly code changes syntactically due to triggering of the bug; and (3) how much such changes do cause regression test suite failures and could be used to manually trigger divergences during execution. The study is conducted with respect to the compilation of more than 10 million lines of C/C++ code from 309 Debian packages, using 12% of the historical and now fixed miscompilation bugs found by four state-of-the-art fuzzers in the Clang/LLVM compiler, as well as 18 bugs found by human users compiling real code or by formal verification. The results show that almost half of the fuzzer-found bugs propagate to the generated binaries for some packages, but rarely affect their syntax and cause two failures in total when running their test suites. User-reported and formal verification bugs do not exhibit a higher impact, with less frequently triggered bugs and one test failure. Our manual analysis of a selection of bugs, either fuzzer-found or not, suggests that none can easily trigger a runtime divergence on the packages considered in the analysis, and that in general they affect only corner cases.

This empirical study has been carried out equally by Michaël Marcozzi and Qiyi Tang.
Files (1.0 GB)
Name Size
compiler_bugs.ova
md5:edbd389e5607211cb5317dce87b885bf
1.0 GB Download
LICENSE
md5:c200a5e2b0dfa7449f45bdb36e3ef01a
2.6 kB Download
README
md5:228a091e54e31e72fa3d658498d92f7e
13.1 kB Download
401
130
views
downloads
All versions This version
Views 401245
Downloads 13067
Data volume 66.3 GB42.4 GB
Unique views 306219
Unique downloads 5835

Share

Cite as