Taming undefined behavior in LLVM

Lee, Jun-Young; Kim, Yoonseung; Song, Youngju; Hur, Chung-Kil; Das, Sanjoy; Majnemer, David; Regehr, John; Lopes, Nuno P.

doi:10.1145/3140587.3062343

Cited by 12 publications

(9 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…If a program contains undened behaviors, compilers may produce varied results. Identifying undened behaviors is a dicult challenge in compiler research [49,78]. It is also a threat in our work, since our mutation may introduce undened behaviors.…”

Section: Discussionmentioning

confidence: 99%

See 1 more Smart Citation

Compiler bug isolation via effective witness test program generation

Chen

Han

Sun

et al. 2019

Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of

View full text Add to dashboard Cite

Compiler bugs are extremely harmful, but are notoriously dicult to debug because compiler bugs usually produce few debugging information. Given a bug-triggering test program for a compiler, hundreds of compiler les are usually involved during compilation, and thus are suspect buggy les. Although there are lots of automated bug isolation techniques, they are not applicable to compilers due to the scalability or eectiveness problem. To solve this problem, in this paper, we transform the compiler bug isolation problem into a search problem, i.e., searching for a set of eective witness test programs that are able to eliminate innocent compiler les from suspects. Based on this intuition, we propose an automated compiler bug isolation technique, DiWi, which (1) proposes a heuristic-based search strategy to generate such a set of eective witness test programs via applying our designed witnessing mutation rules to the given failing test program, and (2) compares their coverage to isolate bugs following the practice of spectrum-based bug isolation. The experimental results on 90 real bugs from popular GCC and LLVM compilers show that DiWi eectively isolates 66.67%/78.89% bugs within Top-10/Top-20 compiler les, signicantly outperforming state-of-the-art bug isolation techniques. CCS CONCEPTS • Software and its engineering → Software testing and debugging.

show abstract

Section: Discussionmentioning

confidence: 99%

“…In DiWi, we only kept the passing programs with the same results to isolate bugs, and thus the threat may be not serious. We will relieve this problem by adopting existing light-weight methods [49] for identifying undened behaviors.…”

Section: Discussionmentioning

confidence: 99%

Compiler bug isolation via effective witness test program generation

Chen

Han

Sun

et al. 2019

Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of

View full text Add to dashboard Cite

show abstract

“…Infamously, LLVM IR supports poisoned values (poison) representing a deferred undefined behavior [Lee et al 2017]. Deferred UB is instrumental for aggressive optimizations, but a semantic subtlety.…”

Section: Dynamic Valuesmentioning

confidence: 99%

“…Moreover, there is ample existing work that aims to build formal semantics for (oftentimes just parts of) the LLVM IR. Notable examples include the Vellvm [Zhao et al 2012[Zhao et al , 2013, Alive [Lopes et al 2015;Menendez and Nagarakatte 2017], Crellvm [Kang et al 2018], and K-LLVM [Li and Gunter 2020] projects, as well as attempts to characterize LLVM's undefined behaviors [Lee et al 2017], its concurrency semantics [Chakraborty and Vafeiadis 2017], and memory models [Kang et al 2015;.…”

Section: Introductionmentioning

confidence: 99%

Modular, compositional, and executable formal semantics for LLVM IR

Zakowski

Beck

Yoon

et al. 2021

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

This paper presents a novel formal semantics, mechanized in Coq, for a large, sequential subset of the LLVM IR. In contrast to previous approaches, which use relationally-specified operational semantics, this new semantics is based on monadic interpretation of interaction trees, a structure that provides a more compositional approach to defining language semantics while retaining the ability to extract an executable interpreter. Our semantics handles many of the LLVM IR's non-trivial language features and is constructed modularly in terms of event handlers, including those that deal with nondeterminism in the specification. We show how this semantics admits compositional reasoning principles derived from the interaction trees equational theory of weak bisimulation, which we extend here to better deal with nondeterminism, and we use them to prove that the extracted reference interpreter faithfully refines the semantic model. We validate the correctness of the semantics by evaluating it on unit tests and LLVM IR programs generated by HELIX.

show abstract

“…Julia is a high level programming language primarily intended for intense data management and scientific computing applications [52]. Although interpreted, it offers high performance [53] as it is based on the low level virtual machine (LLVM) infrastructure engine [54]. The capabilities and the respective performance of the various ML models of Julia are described in Reference [55] especially over massive graphics processing unit (GPU) arrays [56].…”

Section: Previous Workmentioning

confidence: 99%

Extending Fuzzy Cognitive Maps with Tensor-Based Distance Metrics

et al. 2020

View full text Add to dashboard Cite

Cognitive maps are high level representations of the key topological attributes of real or abstract spatial environments progressively built by a sequence of noisy observations. Currently such maps play a crucial role in cognitive sciences as it is believed this is how clusters of dedicated neurons at hippocampus construct internal representations. The latter include physical space and, perhaps more interestingly, abstract fields comprising of interconnected notions such as natural languages. In deep learning cognitive graphs are effective tools for simultaneous dimensionality reduction and visualization with applications among others to edge prediction, ontology alignment, and transfer learning. Fuzzy cognitive graphs have been proposed for representing maps with incomplete knowledge or errors caused by noisy or insufficient observations. The primary contribution of this article is the construction of cognitive map for the sixteen Myers-Briggs personality types with a tensor distance metric. The latter combines two categories of natural language attributes extracted from the namesake Kaggle dataset. To the best of our knowledge linguistic attributes are separated in categories. Moreover, a fuzzy variant of this map is also proposed where a certain personality may be assigned to up to two types with equal probability. The two maps were evaluated based on their topological properties, on their clustering quality, and on how well they fared against the dataset ground truth. The results indicate a superior performance of both maps with the fuzzy variant being better. Based on the findings recommendations are given for engineers and practitioners.

show abstract

Taming undefined behavior in LLVM

Cited by 12 publications

References 20 publications

Compiler bug isolation via effective witness test program generation

Compiler bug isolation via effective witness test program generation

Modular, compositional, and executable formal semantics for LLVM IR

Extending Fuzzy Cognitive Maps with Tensor-Based Distance Metrics

Contact Info

Product

Resources

About