Compiler fuzzing through deep learning

Chris Cummins, Pavlos Petoumenos, Alastair Murray, Hugh Leather
<span title="">2018</span> <i title="ACM Press"> <a target="_blank" rel="noopener" href="https://fatcat.wiki/container/5ttq32n6ujhkxfb7h22ytvohp4" style="color: black;">Proceedings of the 27th ACM SIGSOFT International Symposium on Software Testing and Analysis - ISSTA 2018</a> </i> &nbsp;
Random program generation -fuzzing -is an effective technique for discovering bugs in compilers but successful fuzzers require extensive development effort for every language supported by the compiler, and often leave parts of the language space untested. We introduce DeepSmith, a novel machine learning approach to accelerating compiler validation through the inference of generative models for compiler inputs. Our approach infers a learned model of the structure of real world code based on a
more &raquo; ... ge corpus of open source code. Then, it uses the model to automatically generate tens of thousands of realistic programs. Finally, we apply established differential testing methodologies on them to expose bugs in compilers. We apply our approach to the OpenCL programming language, automatically exposing bugs with little effort on our side. In 1,000 hours of automated testing of commercial and open source compilers, we discover bugs in all of them, submitting 67 bug reports. Our test cases are on average two orders of magnitude smaller than the state-of-the-art, require 3.03× less time to generate and evaluate, and expose bugs which the state-of-the-art cannot. Our random program generator, comprising only 500 lines of code, took 12 hours to train for OpenCL versus the state-of-the-art taking 9 man months to port from a generator for C and 50,000 lines of code. With 18 lines of code we extended our program generator to a second language, uncovering crashes in Solidity compilers in 12 hours of automated testing. CCS CONCEPTS • Software and its engineering → Software testing and debugging;
<span class="external-identifiers"> <a target="_blank" rel="external noopener noreferrer" href="https://doi.org/10.1145/3213846.3213848">doi:10.1145/3213846.3213848</a> <a target="_blank" rel="external noopener" href="https://dblp.org/rec/conf/issta/CumminsPML18.html">dblp:conf/issta/CumminsPML18</a> <a target="_blank" rel="external noopener" href="https://fatcat.wiki/release/frdnak7jmrbfhjrdavjvhr76vm">fatcat:frdnak7jmrbfhjrdavjvhr76vm</a> </span>
<a target="_blank" rel="noopener" href="https://web.archive.org/web/20190427083125/https://www.pure.ed.ac.uk/ws/files/63745798/2018_issta.pdf" title="fulltext PDF download" data-goatcounter-click="serp-fulltext" data-goatcounter-title="serp-fulltext"> <button class="ui simple right pointing dropdown compact black labeled icon button serp-button"> <i class="icon ia-icon"></i> Web Archive [PDF] <div class="menu fulltext-thumbnail"> <img src="https://blobs.fatcat.wiki/thumbnail/pdf/87/09/8709d4d6292d860d8349f617cda335b99ac90826.180px.jpg" alt="fulltext thumbnail" loading="lazy"> </div> </button> </a> <a target="_blank" rel="external noopener noreferrer" href="https://doi.org/10.1145/3213846.3213848"> <button class="ui left aligned compact blue labeled icon button serp-button"> <i class="external alternate icon"></i> acm.org </button> </a>