Directed Test Program Generation for JIT Compiler Bug Localization

TL;DR

This paper introduces a novel method for automatically generating test programs to improve bug localization in JIT compilers by creating inputs that are both similar and dissimilar to seed programs, enhancing bug detection accuracy.

Contribution

It presents a new technique for test program generation that considers both passing and failing inputs, tailored for JIT compiler bug localization, outperforming existing methods.

Findings

Generated test inputs significantly improve bug localization accuracy.

The approach effectively distinguishes between bug-triggering and non-triggering inputs.

Prototype experiments demonstrate superior performance over current techniques.

Abstract

Bug localization techniques for Just-in-Time (JIT) compilers are based on analyzing the execution behaviors of the target JIT compiler on a set of test programs generated for this purpose; characteristics of these test inputs can significantly impact the accuracy of bug localization. However, current approaches for automatic test program generation do not work well for bug localization in JIT compilers. This paper proposes a novel technique for automatic test program generation for JIT compiler bug localization that is based on two key insights: (1) the generated test programs should contain both passing inputs (which do not trigger the bug) and failing inputs (which trigger the bug); and (2) the passing inputs should be as similar as possible to the initial seed input, while the failing programs should be as different as possible from it. We use a structural analysis of the seed program to determine which parts of the code should be mutated for each of the passing and failing cases. Experiments using a prototype implementation indicate that test inputs generated using our approach result in significantly improved bug localization results than existing approaches.