Bug Histories as Sources of Compiler Fuzzing Mutators

• URL: http://arxiv.org/abs/2510.07834v1
• Date: Thu, 09 Oct 2025 06:25:37 GMT
• Title: Bug Histories as Sources of Compiler Fuzzing Mutators
• Abstract summary: We propose IssueMut, the first approach for extracting compiler fuzzing mutators from bug histories.<n>We mine 587 mutators from 1760 GCC and LLVM bug reports.<n>We find that "bug history" mutators are effective: they find new bugs that a state-of-the-art mutational compiler fuzzer misses-28 in GCC and 37 in LLVM.
• Score: 4.429780401631313
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Bugs in compilers, which are critical infrastructure today, can have outsized negative impacts. Mutational fuzzers aid compiler bug detection by systematically mutating compiler inputs, i.e., programs. Their effectiveness depends on the quality of the mutators used. Yet, no prior work used compiler bug histories as a source of mutators. We propose IssueMut, the first approach for extracting compiler fuzzing mutators from bug histories. Our insight is that bug reports contain hints about program elements that induced compiler bugs; they can guide fuzzers towards similar bugs. IssueMut uses an automated method to mine mutators from bug reports and retrofit such mutators into existing mutational compiler fuzzers. Using IssueMut, we mine 587 mutators from 1760 GCC and LLVM bug reports. Then, we run IssueMut on these compilers, with all their test inputs as seed corpora. We find that "bug history" mutators are effective: they find new bugs that a state-of-the-art mutational compiler fuzzer misses-28 in GCC and 37 in LLVM. Of these, 60 were confirmed or fixed, validating our idea that bug histories have rich information that compiler fuzzers should leverage.

Related papers

• Finding and Understanding Miscompilation Bugs in the Solidity Compiler [0.0]
  We created SolSmith to improve the quality of the Solidity compiler.<n>We have discovered 25 miscompilation bugs that went unnoticed, some for multiple years.<n>We classify miscompilation bugs found by SolSmith based on their nature, root-causes, and impact on end-users.
  arXiv  Detail & Related papers  (2026-07-08T09:59:46Z)
• Anchored Self-Play for Code Repair [68.0728003844994]
  Code repair is an important capability for language models (LMs)<n>We propose __generator--fixer self-play__, in which a single model is trained with reinforcement learning to generate bugs and fix them.<n>On BugSourceBench, we find that self-play drifts toward difficult but unrealistic bugs.<n>We propose Anchored Self-Play (ASP), which anchors self-play with a small reference set by adding a code-embedding similarity reward for generation and mixing reference bugs into fixer training.
  arXiv  Detail & Related papers  (2026-07-03T17:51:52Z)
• Discovering 100+ Compiler Defects in 72 Hours via LLM-Driven Semantic Logic Recomposition [15.27741331581011]
  We propose FeatureFuzz, a compiler fuzzer that combines features to generate programs.<n>Over 24-hour campaigns, FeatureFuzz uncovered 167 unique crashes, which is 2.78x more than the second-best fuzzer.<n>Through a 72-hour fuzzing campaign, FeatureFuzz identified 113 bugs in GCC and LLVM, 97 of which have already been confirmed by compiler developers.
  arXiv  Detail & Related papers  (2026-01-18T11:33:45Z)
• BugPilot: Complex Bug Generation for Efficient Learning of SWE Skills [59.003563837981886]
  High quality bugs are key to training the next generation of language model based software engineering (SWE) agents.<n>We introduce a novel method for synthetic generation of difficult and diverse bugs.
  arXiv  Detail & Related papers  (2025-10-22T17:58:56Z)
• Mut4All: Fuzzing Compilers via LLM-Synthesized Mutators Learned from Bug Reports [35.036499451862355]
  Mutation-based fuzzing is effective for uncovering compiler bugs, but designing high-quality mutators for modern languages remains challenging.<n>We present Mut4All, a fully automated, language-agnostic framework that synthesizes mutators using Large Language Models (LLMs) and compiler-specific knowledge from bug reports.
  arXiv  Detail & Related papers  (2025-07-25T13:54:42Z)
• CrashFixer: A crash resolution agent for the Linux kernel [58.152358195983155]
  This work builds upon kGym, which shares a benchmark for system-level Linux kernel bugs and a platform to run experiments on the Linux kernel.<n>This paper introduces CrashFixer, the first LLM-based software repair agent that is applicable to Linux kernel bugs.
  arXiv  Detail & Related papers  (2025-04-29T04:18:51Z)
• Towards Understanding the Bugs in Solidity Compiler [11.193701473232851]
  This paper presents the first systematic study on 533 Solidity compiler bugs. We examine their characteristics (including symptoms, root causes, and distribution) and their triggering test cases. To study the limitations of Solidity compiler fuzzers, we evaluate three Solidity compiler fuzzers.
  arXiv  Detail & Related papers  (2024-07-08T14:22:50Z)
• DebugBench: Evaluating Debugging Capability of Large Language Models [80.73121177868357]
  DebugBench is a benchmark for Large Language Models (LLMs) It covers four major bug categories and 18 minor types in C++, Java, and Python. We evaluate two commercial and four open-source models in a zero-shot scenario.
  arXiv  Detail & Related papers  (2024-01-09T15:46:38Z)
• What Happens When We Fuzz? Investigating OSS-Fuzz Bug History [0.9772968596463595]
  We analyzed 44,102 reported issues made public by OSS-Fuzz prior to March 12, 2022. We identified the bug-contributing commits to estimate when the bug containing code was introduced, and measure the timeline from introduction to detection to fix.
  arXiv  Detail & Related papers  (2023-05-19T05:15:36Z)
• Weakening Assumptions for Publicly-Verifiable Deletion [79.61363884631021]
  We develop a simple compiler that generically adds publicly-verifiable deletion to a variety of cryptosystems. Our compiler only makes use of one-way functions.
  arXiv  Detail & Related papers  (2023-04-19T17:51:28Z)
• Using Developer Discussions to Guide Fixing Bugs in Software [51.00904399653609]
  We propose using bug report discussions, which are available before the task is performed and are also naturally occurring, avoiding the need for additional information from developers. We demonstrate that various forms of natural language context derived from such discussions can aid bug-fixing, even leading to improved performance over using commit messages corresponding to the oracle bug-fixing commits.
  arXiv  Detail & Related papers  (2022-11-11T16:37:33Z)
• Configuring Test Generators using Bug Reports: A Case Study of GCC Compiler and Csmith [2.1016374925364616]
  This paper uses the code snippets in the bug reports to guide the test generation. We evaluate this approach on eight versions of GCC. We find that our approach provides higher coverage and triggers more miscompilation failures than the state-of-the-art test generation techniques for GCC.
  arXiv  Detail & Related papers  (2020-12-19T11:25:13Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.