arXiv:2512.05887cs.SEcs.LG2025-12被引 1

用大模型自动生成编译器测试用例,提升低资源方言的测试覆盖率。

Bootstrapping Fuzzers for Compilers of Low-Resource Language Dialects Using Language Models

  • 基于语法和覆盖引导,结合大模型生成跨方言测试用例。
  • 在91个MLIR方言上使代码覆盖率提升10%-120%。
  • 可发现88个未知缺陷,适合缺乏自动化测试的方言项目使用。

现代可扩展编译框架(如MLIR)支持快速创建领域特定语言方言。但这种灵活性也增加了正确性验证的难度,因开发加速的同时测试基础设施更难维护。现有方法要么需为每个方言手动构建种子语料库,要么缺乏针对性。本文提出一种既跨方言通用又针对方言特性的语法驱动、覆盖引导的模糊测试方法:利用方言规范自动提取语法,再结合预训练大模型生成覆盖全方言空间的多样化测试输入,无需人工干预或训练数据。该方法已集成至工具Germinator。在6个包含91个方言的MLIR项目上,生成的种子使线覆盖率相比基线提升10%-120%。与仅有的可统一应用于异构方言生态的语法基基线对比,Germinator发现了88个此前未知的漏洞(40个已确认),其中23个出现在无自动化测试生成器的方言中,证明了对低资源方言的大规模有效可控测试能力。

原文摘要 · Abstract (English)

Modern extensible compiler frameworks-such as MLIR-enable rapid creation of domain-specific language dialects. This flexibility, however, makes correctness harder to ensure as the same extensibility that accelerates development also complicates maintaining the testing infrastructure. Extensible languages require automated test generation that is both dialect-agnostic (works across dialects without manual adaptation) and dialect-effective (targets dialect-specific features to find bugs). Existing approaches typically sacrifice one of these goals by either requiring manually constructed seed corpora for each dialect, or by failing to be effective. We present a dialect-agnostic and dialect-effective grammar-based and coverage-guided fuzzing approach for extensible compilers that combines two key insights from existing work: (i) the grammars of dialects, which already encode the structural and type constraints, can often be extracted automatically from the dialect specification; and (ii) these grammars can be used in combination with pre-trained large language models to automatically generate representative and diverse seed inputs from the full dialect space without requiring any manual input or training data. These seeds can then be used to bootstrap coverage-guided fuzzers. We built this approach into a tool, Germinator. When evaluated on six MLIR projects spanning 91 dialects, Germinator generated seeds improve line coverage by 10-120% over grammar-based baselines. We compare against grammar-based baselines because they are the only class of existing automatic seed generators that can be applied uniformly across MLIR's heterogeneous dialect ecosystem. Germinator discovers 88 previously unknown bugs (40 confirmed), including 23 in dialects with no prior automated test generators, demonstrating effective and controllable testing of low-resource dialects at scale.

编译器模糊测试大模型MLIR

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。