Making no-fuss compiler fuzzing effective

Developing a bug-free compiler is difficult; modern optimizing compilers are among the most complex software systems humans build. Fuzzing is one way to identify subtle compiler bugs that are hard to find with human-constructed tests. Grammar-based fuzzing, however, requires a grammar for a compiler’s input language, and can miss bugs induced by code that does not actually satisfy the grammar the compiler should accept. Grammar-based fuzzing also seldom uses advanced modern fuzzing techniques based on coverage feedback. However, modern mutation-based fuzzers are often ineffective for testing compilers because most inputs they generate do not even come close to getting past the parsing stage of compilation. This paper introduces a technique for taking a modern mutation-based fuzzer (AFL in our case, but the method is general) and augmenting it with operators taken from mutation testing, and program splicing. We conduct a controlled study to show that our hybrid approaches significantly improve fuzzing effectiveness qualitatively (consistently finding unique bugs that baseline approaches do not) and quantitatively (typically finding more unique bugs in the same time span, despite fewer program executions). Our easy-to-apply approach has allowed us to report more than 100 confirmed and fixed bugs in production compilers, and found a bug in the Solidity compiler that earned a security bounty.

开发无虫的编译器很困难。编译器输入语言的语法，并且可能会错过由编译器的语法所诱导的错误很少基于覆盖范围的反馈使用先进的现代模糊技术。基于现代突变的模糊器（在我们的情况下，AFL，但该方法是一般的），并通过从突变测试中获取的操作员加强了它，我们进行了一个受控的剪接。研究表明，我们的混合方法显着提高了模糊的效果（始终如一地找到基线方法无法使用的唯一错误）并定量（通常在同一时间范围内找到更多独特的错误，dospite较少的程序执行）允许我们在生产编译器中报告100多个已确认和固定错误，并在固体编译器中发现了一个赢得安全弹跳的错误。