Rust's Type Checker Implementation Is Unsound: An Empirical Study on Soundness Bugs in rustc

• URL: http://arxiv.org/abs/2608.28713v1
• Date: Fri, 28 Aug 2026 07:59:19 GMT
• Title: Rust's Type Checker Implementation Is Unsound: An Empirical Study on Soundness Bugs in rustc
• Abstract summary: Rust is claimed to be a type-sound language capable of preventing undesirable behaviors, including memory bugs.<n>Rustc is not immune to defects; it contains soundness bugs, where the compiler accepts programs that should be rejected.<n>We present an empirical study of 30 issues that report potential soundness bugs in rustc, collected from the GitHub issue tracker.
• Score: 5.513280759193012
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Rust is claimed to be a type-sound language capable of preventing various undesirable behaviors, including memory bugs. However, rustc, the official Rust compiler, is not immune to defects; it contains soundness bugs, where the compiler accepts programs that should be rejected during type checking. In this work, we present an empirical study of 30 issues that report potential soundness bugs in rustc, collected from the GitHub issue tracker between January 1, 2022 and September 1, 2025. We analyze each issue in depth, focusing on its affected feature, symptom (how the feature is mishandled), consequence (the resulting undesirable behavior), triggering features, community consensus regarding whether it is a bug, and lifecycle, including introduction, discovery, and fix. Furthermore, we investigate existing artifacts, including implementations such as AddressSanitizer, Miri, Chalk, and a-mir-formality, alongside documentation such as the Rust Reference, the FLS, and Rust RFCs to assess their potential as oracles for testing the type soundness of rustc. Our key findings indicate that: (1) Certain soundness bugs, typically triggered by implied bounds or trait objects, compromise memory safety. (2) Sound type checking is challenged by edge cases involving associated types and the interaction between lifetimes and traits. (3) Most bugs persist from the initial introduction of the relevant features and require significant time to be discovered. (4) While AddressSanitizer and Miri can detect soundness bugs that lead to memory bugs, a-mir-formality and Chalk are currently immature despite their potential to identify other bug categories. (5) Existing documentation frequently fails to provide precise explanations of the language semantics.

Related papers

• Writing Bug Reports for Software Repair Agents: What Information Matters Most? [45.10027008889631]
  We study what makes a bug report agent-ready.<n>We focus on the 441 issues representing bug reports.<n>Our results suggest that agentic-first reports benefit most from information that narrows the agent's search and repair space.
  arXiv  Detail & Related papers  (2026-07-10T16:00:57Z)
• Kani: A Model Checker for Rust [3.019677299390329]
  Kani is an open-source model checker for Rust.<n>It pushes bounded model checking beyond bug-finding to provide correctness guarantees.<n>Kani operates at scale in production CI, with over 16,000 harnesses verified per code change.
  arXiv  Detail & Related papers  (2026-07-01T22:05:33Z)
• WESR: Scaling and Evaluating Word-level Event-Speech Recognition [59.21814194620928]
  Speech conveys not only linguistic information but also rich non-verbal vocal events such as laughing and crying.<n>We develop a refined taxonomy of 21 vocal events, with a new categorization into discrete (standalone) versus continuous (mixed with speech) types.<n>Based on the refined taxonomy, we introduce WESR-Bench, an expert-annotated evaluation set (900+ utterances) with a novel position-aware protocol.
  arXiv  Detail & Related papers  (2026-01-08T02:23:21Z)
• Understanding Typing-Related Bugs in Solidity Compiler [20.643091052140118]
  This paper presents the first systematic empirical study on typing-related bugs in the Solidity compiler.<n>For each bug, we conducted an in-depth analysis and classification from four dimensions: symptoms, root causes, exposure conditions, and fix strategies.
  arXiv  Detail & Related papers  (2025-12-20T02:37:10Z)
• BugPilot: Complex Bug Generation for Efficient Learning of SWE Skills [59.003563837981886]
  High quality bugs are key to training the next generation of language model based software engineering (SWE) agents.<n>We introduce a novel method for synthetic generation of difficult and diverse bugs.
  arXiv  Detail & Related papers  (2025-10-22T17:58:56Z)
• What Do They Fix? LLM-Aided Categorization of Security Patches for Critical Memory Bugs [46.325755802511026]
  We developLM, a dual-method pipeline that integrates two approaches based on a Large Language Model (LLM) and a fine-tuned small language model.<n>LM successfully identified 111 of 5,140 recent Linux kernel patches addressing OOB or UAF vulnerabilities, with 90 true positives confirmed by manual verification.
  arXiv  Detail & Related papers  (2025-09-26T18:06:36Z)
• CRUST-Bench: A Comprehensive Benchmark for C-to-safe-Rust Transpilation [51.18863297461463]
  CRUST-Bench is a dataset of 100 C repositories, each paired with manually-written interfaces in safe Rust as well as test cases.<n>We evaluate state-of-the-art large language models (LLMs) on this task and find that safe and idiomatic Rust generation is still a challenging problem.<n>The best performing model, OpenAI o1, is able to solve only 15 tasks in a single-shot setting.
  arXiv  Detail & Related papers  (2025-04-21T17:33:33Z)
• TYPEPULSE: Detecting Type Confusion Bugs in Rust Programs [17.491119986027925]
  Rust supports type conversions and safe Rust guarantees the security of these conversions.<n>These conversions may cause severe memory corruption problems.<n>Despite extensive research on type confusion bugs in C/C++, studies on type confusion bugs in Rust are still lacking.
  arXiv  Detail & Related papers  (2025-02-05T15:27:08Z)
• A Study of Undefined Behavior Across Foreign Function Boundaries in Rust Libraries [2.359557447960552]
  Rust is frequently used to interoperate with other languages.<n>Miri is the only dynamic analysis tool that can validate applications against these models.<n>Miri does not support finding bugs in foreign functions, indicating that there may be a critical correctness gap across the Rust ecosystem.
  arXiv  Detail & Related papers  (2024-04-17T18:12:05Z)
• Yuga: Automatically Detecting Lifetime Annotation Bugs in the Rust Language [15.164423552903571]
  Security vulnerabilities have been reported in Rust projects, often attributed to the use of "unsafe" Rust code.<n>These vulnerabilities, in part, arise from incorrect lifetime annotations on function signatures.<n>Existing tools fail to detect these bugs, primarily because such bugs are rare, challenging to detect through dynamic analysis.<n>We devise a novel static analysis tool, Yuga, to detect potential lifetime annotation bugs.
  arXiv  Detail & Related papers  (2023-10-12T17:05:03Z)
• Using Developer Discussions to Guide Fixing Bugs in Software [51.00904399653609]
  We propose using bug report discussions, which are available before the task is performed and are also naturally occurring, avoiding the need for additional information from developers. We demonstrate that various forms of natural language context derived from such discussions can aid bug-fixing, even leading to improved performance over using commit messages corresponding to the oracle bug-fixing commits.
  arXiv  Detail & Related papers  (2022-11-11T16:37:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.