Compiler Testing using Template Java Programs
Compiler Testing using Template Java Programs
复制标题
DOI：
10.1145/3551349.3556958
复制
发表时间：
2022-09
期刊：
影响因子：
--
通讯作者：
Zhiqiang Zang;Nathan Wiatrek;Miloš Gligorić;A. Shi
中科院分区：
文献类型：
--
作者：
Zhiqiang Zang;Nathan Wiatrek;Miloš Gligorić;A. Shi
我们介绍了JAttack，这是一个支持对编译器进行基于模板的测试的框架。开发人员使用JAttack编写模板程序，该模板程序描述要生成的一组程序，并将其作为测试输入提供给编译器。这样的框架使开发人员能够将他们在测试编译器方面的领域知识结合在一起，提供了一个基本的程序结构，允许探索可以触发复杂编译器优化的复杂程序。开发人员用宿主语言(Java)编写了一个模板程序，其中包含要由JAttack填充的漏洞。每个洞使用特定于域的语言编写，在扩展的抽象语法树(EAST)中构造一个节点。East节点定义孔的搜索空间，即一组表达式和值。JAttack通过执行模板生成程序，并通过随机选择表达式和值来填充每个洞(在洞定义的搜索空间内可用)。此外，我们还引入了几个优化来降低JAttack的生成成本。虽然JAttack可以用于测试各种编译器功能，但我们演示了它在帮助测试实时(JIT)Java编译器方面的能力，这些编译器的优化在足够数量的执行后在运行时发生。使用JAttack，我们发现了Oracle开发人员确认的六个关键错误。其中四个以前是未知的，包括两个未知的CVE(常见漏洞和暴露)。JAttack展示了将开发人员的领域知识(通过模板)与随机测试相结合来检测JIT编译器中的错误的能力。
We present JAttack, a framework that enables template-based testing for compilers. Using JAttack, a developer writes a template program that describes a set of programs to be generated and given as test inputs to a compiler. Such a framework enables developers to incorporate their domain knowledge on testing compilers, giving a basic program structure that allows for exploring complex programs that can trigger sophisticated compiler optimizations. A developer writes a template program in the host language (Java) that contains holes to be filled by JAttack. Each hole, written using a domain-specific language, constructs a node within an extended abstract syntax tree (eAST). An eAST node defines the search space for the hole, i.e., a set of expressions and values. JAttack generates programs by executing templates and filling each hole by randomly choosing expressions and values (available within the search space defined by the hole). Additionally, we introduce several optimizations to reduce JAttack’s generation cost. While JAttack could be used to test various compiler features, we demonstrate its capabilities in helping test just-in-time (JIT) Java compilers, whose optimizations occur at runtime after a sufficient number of executions. Using JAttack, we have found six critical bugs that were confirmed by Oracle developers. Four of them were previously unknown, including two unknown CVEs (Common Vulnerabilities and Exposures). JAttack shows the power of combining developers’ domain knowledge (via templates) with random testing to detect bugs in JIT compilers.