Finding Unstable Code via Compiler-Driven Differential Testing

Shaohua Li, Zhendong Su. 2023. International Conference on Architectural Support for Programming Languages and Operating Systems.

Read the paper · doi:10.1145/3582016.3582053

What this paper does with SQLancer

SQLancer appears once, as a bibliography entry for non-optimizing reference engine construction in a discussion of differential approaches. CompDiff finds unstable code -- code whose run-time semantics vary because of undefined behaviour, which compilers exploit by assuming it never happens. Sanitizers cover frequently occurring undefined behaviours, but detecting the rest remains hard. CompDiff rests on the observation that different compilers may produce semantically inconsistent binaries from unstable code, so it compares the outputs of differently compiled binaries on the same input. Integrated into AFL++ it found 78 new bugs across 23 open-source projects. Written by claude-opus-5 from the 1 place this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (1)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
39	Manuel Rigger and Zhendong Su. 2020. Detecting optimization bugs in database engines via non-optimizing reference engine construction. In Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conf...	sqlancer publication · NOREC

Every place it refers to SQLancer (1)

1 sentence, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	Researchers have leveraged differential testing to find semantic bugs across many types of programs, such as database management systems [ 39], Java Virtual Machine (JVM) implementations [ 8], REST APIs [ 18], and compilers [ 27].	citation marker background	4.3 CompDiff-AFL++ page 12

This page is rendered from _data/papers/paper_doi_10_1145_3582016_3582053.json, extracted from supplied pdf. 14 pages, 51 references parsed.