Fuzzing C++ Compilers via Type-Driven Mutation
summary
TyMut is a mutation-based C++ type-system fuzzer that runs for 32 hours to generate and test 250,584 programs, using 30 mutation operators across five categories (inheritance, templates, conversions, accessibility, object lifecycle). A must analysis yields definite oracles for ~80% of cases; remaining programs use differential testing. The campaign uncovers 102 bugs in GCC/Clang (56 confirmed), including 26 crashes, >50% miscompilations, and several issues hidden for over 20 years — one traced to a TensorFlow bug.
AI-written summary · about
chapters (8)
- 0:00C++ compiler testing intro
- 2:16C++ type system complexity
- 4:0219-year-old GCC bug example
- 5:49Fuzzing limitations
- 6:34TyMuTe overview
- 9:51Valid and invalid programs
- 10:12Evaluation results and bugs
- 12:01Q&A
related talks
13mOn the Unusual Effectiveness of Type-Aware Operator Mutations for Testing SMT Solvers
44mTesting The Tests: Mutation Testing for C++
20mUnleashing the Power of Mutation Testing: Supercharging Software Quality and Resilien...
46m"But my tests passed!" - Exploring C++ Test Suite Weaknesses with Mutation Testing
12mGenerative Type-Aware Mutation for Testing SMT Solvers
18mOptimization-Directed Compiler Fuzzing for Continuous Translation Validation
52mStructure aware fuzzing
40mMutation Testing: How Good Are Your Tests