Scholarlink

<p>History-driven fuzzing is a viable method to expose compiler bugs. It leverages historical information, such as historical test programs and historical execution information, to locate error-prone modules and conduct continuous testing. However, existing works are inefficient in utilizing historical information, resulting in a limited bug-triggering capability. In this work, we propose <span>SSFuzz</span>, a compiler fuzzer that synthesizes bug-triggering code segments into test cases and schedules both seed programs and code segments. <span>SSFuzz</span>&#xa0;collects bug-triggering code segments from bug-related pull requests and synthesizes them into test cases using different strategies. During the period of testing, <span>SSFuzz</span>&#xa0;uses an entropy-based scheduler to prioritize code segments based on the behavior of target JVMs, and retain test cases as seed programs according to the anomalous behavior feedback and code coverage feedback. During the bug submission phase, <span>SSFuzz</span>&#xa0;successfully uncovered 20&#xa0;previously undetected bugs across all three target JVMs. Out of these, 14&#xa0;have been verified, and 3&#xa0;have already been fixed. Compared with state-of-the-art fuzzers, <span>SSFuzz</span>&#xa0;uncovers <InlineEquation ID="IEq1"> <EquationSource Format="TEX">\(1.3 \sim 3.1\times\)</EquationSource> </InlineEquation> more bugs and achieves the highest code coverage.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

SSFuzz: Synthesizing and scheduling bug-triggering code segments for history-driven compiler testing

  • 期刊论文

  • 发表日期：

    2025年12月5日

查看全文
  • Tianmin Hu,
  • Zhenye Fan,
  • Zhanbo Ye,
  • Guixin Ye,
  • Lu He

摘要

History-driven fuzzing is a viable method to expose compiler bugs. It leverages historical information, such as historical test programs and historical execution information, to locate error-prone modules and conduct continuous testing. However, existing works are inefficient in utilizing historical information, resulting in a limited bug-triggering capability. In this work, we propose SSFuzz, a compiler fuzzer that synthesizes bug-triggering code segments into test cases and schedules both seed programs and code segments. SSFuzz collects bug-triggering code segments from bug-related pull requests and synthesizes them into test cases using different strategies. During the period of testing, SSFuzz uses an entropy-based scheduler to prioritize code segments based on the behavior of target JVMs, and retain test cases as seed programs according to the anomalous behavior feedback and code coverage feedback. During the bug submission phase, SSFuzz successfully uncovered 20 previously undetected bugs across all three target JVMs. Out of these, 14 have been verified, and 3 have already been fixed. Compared with state-of-the-art fuzzers, SSFuzz uncovers \(1.3 \sim 3.1\times\) more bugs and achieves the highest code coverage.