Finding and strongUnderstandingstrong Bugs in C Compilers.pdfVIP

Finding and Understanding Bugs in C Compilers Xuejun Yang Yang Chen Eric Eide John Regehr University of Utah, School of Computing { jxyang , chenyang, eeide, regehr }@ Abstract 1 int foo (void) { Compilers should be correct. To improve the quality of C compilers, 2 signed char x = 1; we created Csmith, a randomized test-case generation tool, and 3 unsigned char y = 255; spent three years using it to find compiler bugs. During this period 4 return x y; we reported more than 325 previously unknown bugs to compiler 5 } developers. Every compiler we tested was found to crash and also to silently generate wrong code when presented with valid input. Figure 1. We found a bug in the version of GCC that shipped with In this paper we present our compiler-testing tool and the results Ubuntu Linux 8.04.1 for x86. At all optimization levels it compiles of our bug-hunting study. Our first contribution is to advance the this function to return 1; the correct result is 0. The Ubuntu compiler state of the art in compiler testing. Unlike previous tools, Csmith was heavily patched; the base version of GCC did not have this bug. generates programs that cover a large subset of C while avoiding the undefined and unspecified behaviors that would destroy its ability to automatically find wrong-code bugs. Our second contribution is a We created Csmith, a randomized test-case generator that sup- collection of qualitative and quantitative results about the bugs we ports