Random Testing for C and C++ Compilers with YARPGen
summary
YARPGen is a C/C++ fuzzer that generates UB-free code by exact value tracking and operation swapping for arithmetic trees, applies generation policies (contexts, constant neighborhoods, parameter shuffling) to target scalar optimizations, and feeds an automated pipeline with differential testing, CReduce support and a bug classifier that groups failures by assert messages and optimization-disabling. An experiment shows policies increase rediscovery rates for nine bugs, YARPGen spends ~5% of test time while compilation is ~95%, and it finds >220 bugs in GCC, LLVM and Intel C++.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:30Why Yet Another C Compiler Fuzzer?
- 1:34Requirements
- 2:02Arithmetic Expression Tree
- 2:42Undefined Behavior Avoidance
- 3:22Rewrite Rules
- 3:44Generation Policies: Overview
- 4:19Generation Policies: Contexts
- 6:02Impact of Generation Policies (GP) Evaluation through bug rediscovery process
- 7:14Automation
- 7:49Bug Classification
- 8:17Sample Report: LLVM bug #32830
- 8:58Testing Performance
- 9:58Limitations
- 10:32Reported Bugs: Overview
- 10:52Reported Bugs: GCC
- 11:07Reported Bugs: LLVM
- 11:25Reported Bugs: Intel® C++ Compiler
related talks
17mFuzzing Loop Optimizations in Compilers for C++ and Data-Parallel Languages
53mLocknote: How Badly Do We Want Correct Compilers?
20mRefined Input, Degraded Output: The Counterintuitive World of Compiler Behavior
19mExploiting Undefined Behavior in C/C++ Programs for Optimization: A Study on the(…)
22mBoosting Compiler Testing by Injecting Real-World Code
14mFuzzing C++ Compilers via Type-Driven Mutation
31mThe AST Galaxy to the Virtual Machine Blues
33mRuby the Hard Way: Writing Bytecode to Optimize Plain Ruby