Finding and Understanding Bugs in C Compilers Xuejun Yang Yang Chen Eric Eide John Regehr University of Utah

C compilers should be correct – Part of trusted computing base – Used to compile OS and safety critical applications But sometimes compilers are incorrect – Fail to compile a valid program – Generate wrong code 2

Contributions Developed Csmith, a random C program generator that is expressive and generates unambiguous code Used Csmith to find 382 bugs in widely used C compilers – Most of the bugs have been fixed 3

Random Generator: Csmith gcc -O0gcc -O2clang -Os … vote minority majority C program results 4

5

6

Why Csmith Works Unambiguous: avoid undefined or unspecified behaviors that create ambiguous meanings of a program Integer operations Loops (with break/continue) Conditionals Function calls Const and volatile Structs and Bitfields Pointers and arrays Goto Expressiveness: support most commonly used C features 7 Integer undefined behavior Use without initialization Unspecified evaluation order Use of dangling pointer Null pointer dereference OOB array access

8

Avoiding Undefined/unspecified Behaviors 9 ProblemGeneration Time SolutionRun Time Solution Integer undefined behaviors Constant folding/propagation Algebraic simplification Safe math wrappers Use without initialization explicit initializers OOB array accessForce index within rangeTake modulus Null pointer dereference Inter-procedural points-to analysis Use of dangling pointers Inter-procedural points-to analysis Unspecified evaluation order Inter-procedural effect analysis

Code Generator 10 assign call func_2 validate ok? Generation Time Analyzer no *q … RHS LHS

Code Generator 11 assign call func_2 Generation Time Analyzer … RHS LHS

*p 12 *p Code Generator update facts assign call func_2 validate ok? yes Generation Time Analyzer … RHS LHS

From March, 2008 to present: Do they matter? – 25 priority 1 bugs for GCC – 8 of our bugs were re-reported by others CompilerBugs reported (fixed) GCC104 (86) LLVM228 (221) Others (Compcert, icc, armcc, tcc, cil, suncc, open64, etc) 50 Total Accounts for 1% total valid GCC bugs reported in the same period Accounts for 3.5% total valid LLVM bugs reported in the same period

Bug Dist. Across Compiler Stages GCCLLVM Front end111 Middle end7193 Back end2878 Unclassified446 Total

15 Coverage of GCCCoverage of LLVM/Clang

Common Compiler Bug Pattern Analysis Safety Check Transformation Y N if (condition1 && condition2 ) 16 missing safety condition Compiler Optimization

CompCert Bugs Certified C compiler 11 bugs reported – All in the unproved front end or back end – No bugs in the proved part Developing compiler optimizations within a proof framework is helpful for compiler correctness 17

Conclusion By randomly generating expressive and unambiguous test cases, we have found, and continue to find, compiler bugs effectively Csmith is open source: 18