Closer to the edge
Closer to the edge
复制标题
离边缘更近
DOI：
10.1145/3324884.3418933
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Even-Mendoza K
中科院分区：
文献类型：
--
作者：
Even-Mendoza K
随机编译器测试技术需要一种生成程序的方法，这些程序没有未定义行为（UB），以便可靠地揭示错误编译错误。现有的程序生成器，如Csmith，严重限制了生成程序的形式，以实现UB自由。我们假设，这类程序的惯用性质限制了它们所能提供的测试覆盖率。我们的想法是生成限制较少的程序，这些程序仍然是无UB的-程序更接近UB的边缘，但不太越过边缘。我们提出了初步支持我们的想法，通过一个原型工具，CsmithEdge，它使用简单的动态分析，以确定Csmith一直过于保守，在其使用ofsafe数学包装，保证UB自由的算术运算。通过消除冗余的包装器，CsmithEdge能够发现GCC中两个新的错误编译错误，这是通过使用常规Csmith进行密集测试无法发现的，并且与常规Csmith相比，GCC的代码覆盖率有很大差异。
Randomised compiler testing techniques require a means of generating programs that are free from undefined behaviour (UB) in order to reliably reveal miscompilation bugs. Existing program generators such as Csmith heavily restrict the form of generated programs in order to achieve UB-freedom. We hypothesise that the idiomatic nature of such programs limits the test coverage they can offer. Our idea is to generate less restricted programs that are still UB-free---programs that get closer to the edge of UB, but that do not quite cross the edge. We present preliminary support for our idea via a prototype tool, CsmithEdge, which uses simple dynamic analysis to determine where Csmith has been too conservative in its use ofsafe mathwrappers that guarantee UB-freedom for arithmetic operations. By eliminating redundant wrappers, CsmithEdge was able to discover two new miscompilation bugs in GCC that could not be found via intensive testing using regular Csmith, and to achieve substantial differences in code coverage on GCC compared with regular Csmith.