Search papers, labs, and topics across Lattice.
This paper introduces CLIR, a novel differential testing framework designed to enhance the testing of the Cranelift compiler by addressing unique challenges such as SSA form enforcement and computational density. By employing a syntax-preserving hierarchical generation strategy, a liveness-guided instruction refinement mechanism, and a diagnosis-guided cross-architecture adaptation scheme, CLIR achieves superior bug detection capabilities. The framework outperforms existing tools, identifying 24 bugs across multiple architectures within 72 hours, with a significant increase in unique bug detection compared to state-of-the-art methods.
CLIR uncovers 8x more unique bugs than existing fuzzing tools, revolutionizing compiler testing efficiency and effectiveness.
Modern compilers are complex software systems that must correctly translate high-level programming languages into machine code across multiple architectures. Cranelift, a fast and modern compiler backend originally developed for WebAssembly and recently adopted as an experimental backend for Rust, has gained increasing importance due to its superior compilation speed compared to LLVM and comprehensive multi-architecture support, including x86-64, AArch64, s390x, and RISCV64. However, despite decades of development in compiler testing, testing Cranelift still presents unique challenges, including (1) constructing valid IR under the strict enforcement of SSA form, (2) generating sequences with sufficient computational density to stress backend components, and (3) balancing broad backend coverage with efficient root cause analysis across heterogeneous architectures. To address these challenges, we propose CLIR, a differential testing framework that integrates a syntax-preserving hierarchical generation strategy to guarantee SSA validity, a liveness-guided instruction refinement mechanism to maximize computational density, and a diagnosis-guided cross-architecture adaptation scheme to facilitate efficient root cause analysis across heterogeneous backends. Our comprehensive evaluation demonstrates that CLIR significantly outperforms existing state-of-the-art baselines, detecting 8x, 24x, and 8x more unique bugs than cranelift-fuzzgen, wasm-smith, and WASMaker, respectively, while RustSmith uncovered no bugs. Consequently, within 72 hours of testing, CLIR discovered 24 bugs spanning all target architectures, with 21 confirmed and 9 fixed.
Microsoft Research