cid ca3df3d0c99731e3ff3e1d4dd71f601acf54af8b7b3e4119a4ce133c6b5e607a · original · open access · via openalex
Title: CLIR: Liveness-Driven and Structure-Aware Fuzzing for the Cranelift Compiler Authors: Shangtong Cao; 宋天磊; Qiuping Yi; T X Chen; Guoai Xu; Ningyu He; Haoyu Wang Venue: Proceedings of the ACM on software engineering. Year: 2026 Canonical: doi:10.1145/3832230 URL: https://doi.org/10.1145/3832230 Collector: openalex OA: true ABSTRACT Modern compilers are complex software systems that must correctly translate high-level programming languages into machine code across multiple architectures. Cranelift, a fast and modern compiler backend originally developed for WebAssembly and recently adopted as an experimental backend for Rust, has gained increasing importance due to its superior compilation speed compared to LLVM and comprehensive multi-architecture support, including x86-64, AArch64, s390x, and RISCV64. However, despite decades of development in compiler testing, testing Cranelift still presents unique challenges, including (1) constructing valid IR under the strict enforcement of SSA form, (2) generating sequences with sufficient computational density to stress backend components, and (3) balancing broad backend coverage with efficient root cause analysis across heterogeneous architectures. To address these challenges, we propose CLIR, a differential testing framework that integrates a syntax-preserving hierarchical generation strategy to guarantee SSA validity, a liveness-guided instruction refinement mechanism to maximize computational density, and a diagnosis-guided cross-architecture adaptation scheme to facilitate efficient root cause analysis across heterogeneous backends. Our comprehensive evaluation demonstrates that CLIR substantially outperforms existing state-of-the-art baselines, detecting 8×, 24×, and 8× as many unique bugs as cranelift-fuzzgen, wasm-smith, and WASMaker, respectively, while RustSmith uncovered no bugs. Within 72 hours of testing, CLIR discovered 24 bugs spanning all target architectures, with 21 confirmed and 9 fixed.